KNOTWEED AV Detection

Back


Id	9f9c1e51-4fb1-4510-a675-c7c2fb32f47e
Rulename	KNOTWEED AV Detection
Description	This query looks for Microsoft Defender AV detections related to the KNOTWEED threat actor and the Corelump and Jumplump malware. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
Severity	High
Tactics	Execution
Techniques	T1203
Required data connectors	MicrosoftThreatProtection SecurityEvents
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Legacy IOC based Threat Protection/Analytic Rules/KNOTWEEDAVDetection.yaml
Version	1.0.1
Arm template	9f9c1e51-4fb1-4510-a675-c7c2fb32f47e.json

KQL

let knotweed_sigs = dynamic(["JumplumpDropper", "Jumplump", "Corelump", "Medcerc", "SuspModuleLoad", "Mexlib"]);
  let mde_data = (DeviceInfo
    | extend DeviceName = tolower(DeviceName)
    | join kind=rightouter ( SecurityAlert
    | where ProviderName =~ "MDATP"
    | extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)
    | extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
    | where ThreatFamilyName in~ (knotweed_sigs)
    | extend CompromisedEntity = tolower(CompromisedEntity)
    ) on $left.DeviceName == $right.CompromisedEntity);
  let event_data = ( Event
    | where EventID in (1006, 1009, 1116, 1119)
    | extend ThreatData = parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_xml(EventData).DataItem)).EventData)).Data))
    | mv-expand ThreatData
    | where tostring(ThreatData.["@Name"]) == "Threat Name"
    | extend EventData = parse_xml(EventData)
    | where tostring(ThreatData.["#text"]) has_any (knotweed_sigs));
  union mde_data, event_data
  | extend ThreatName = iif(isnotempty(ThreatName), ThreatName, tostring(ThreatData.["#text"]))
  | extend ThreatFamilyName = iif(isnotempty(ThreatFamilyName), ThreatFamilyName, split(tostring(ThreatData.["#text"]), "/")[-1])
  | extend TimeGenerated = iif(isnotempty(TimeGenerated), TimeGenerated, TimeGenerated1)
  | extend DeviceName = iif(isnotempty(DeviceName), DeviceName, Computer)
  | project-reorder TimeGenerated, CompromisedEntity, ThreatName, ThreatFamilyName

YAML

name: KNOTWEED AV Detection
query: |
  let knotweed_sigs = dynamic(["JumplumpDropper", "Jumplump", "Corelump", "Medcerc", "SuspModuleLoad", "Mexlib"]);
    let mde_data = (DeviceInfo
      | extend DeviceName = tolower(DeviceName)
      | join kind=rightouter ( SecurityAlert
      | where ProviderName =~ "MDATP"
      | extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)
      | extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)
      | where ThreatFamilyName in~ (knotweed_sigs)
      | extend CompromisedEntity = tolower(CompromisedEntity)
      ) on $left.DeviceName == $right.CompromisedEntity);
    let event_data = ( Event
      | where EventID in (1006, 1009, 1116, 1119)
      | extend ThreatData = parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_xml(EventData).DataItem)).EventData)).Data))
      | mv-expand ThreatData
      | where tostring(ThreatData.["@Name"]) == "Threat Name"
      | extend EventData = parse_xml(EventData)
      | where tostring(ThreatData.["#text"]) has_any (knotweed_sigs));
    union mde_data, event_data
    | extend ThreatName = iif(isnotempty(ThreatName), ThreatName, tostring(ThreatData.["#text"]))
    | extend ThreatFamilyName = iif(isnotempty(ThreatFamilyName), ThreatFamilyName, split(tostring(ThreatData.["#text"]), "/")[-1])
    | extend TimeGenerated = iif(isnotempty(TimeGenerated), TimeGenerated, TimeGenerated1)
    | extend DeviceName = iif(isnotempty(DeviceName), DeviceName, Computer)
    | project-reorder TimeGenerated, CompromisedEntity, ThreatName, ThreatFamilyName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Legacy IOC based Threat Protection/Analytic Rules/KNOTWEEDAVDetection.yaml
queryFrequency: 1d
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - DeviceInfo
  connectorId: MicrosoftThreatProtection
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
version: 1.0.1
status: Available
queryPeriod: 1d
id: 9f9c1e51-4fb1-4510-a675-c7c2fb32f47e
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: DeviceName
  entityType: Host
tags:
- KNOTWEED
relevantTechniques:
- T1203
severity: High
description: |
  'This query looks for Microsoft Defender AV detections related to the KNOTWEED threat actor and the Corelump and Jumplump malware.
    Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'  
kind: Scheduled
tactics:
- Execution

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9f9c1e51-4fb1-4510-a675-c7c2fb32f47e')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9f9c1e51-4fb1-4510-a675-c7c2fb32f47e')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "KNOTWEED AV Detection",
        "description": "'This query looks for Microsoft Defender AV detections related to the KNOTWEED threat actor and the Corelump and Jumplump malware.\n  Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'\n",
        "severity": "High",
        "enabled": true,
        "query": "let knotweed_sigs = dynamic([\"JumplumpDropper\", \"Jumplump\", \"Corelump\", \"Medcerc\", \"SuspModuleLoad\", \"Mexlib\"]);\n  let mde_data = (DeviceInfo\n    | extend DeviceName = tolower(DeviceName)\n    | join kind=rightouter ( SecurityAlert\n    | where ProviderName =~ \"MDATP\"\n    | extend ThreatName = tostring(parse_json(ExtendedProperties).ThreatName)\n    | extend ThreatFamilyName = tostring(parse_json(ExtendedProperties).ThreatFamilyName)\n    | where ThreatFamilyName in~ (knotweed_sigs)\n    | extend CompromisedEntity = tolower(CompromisedEntity)\n    ) on $left.DeviceName == $right.CompromisedEntity);\n  let event_data = ( Event\n    | where EventID in (1006, 1009, 1116, 1119)\n    | extend ThreatData = parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_xml(EventData).DataItem)).EventData)).Data))\n    | mv-expand ThreatData\n    | where tostring(ThreatData.[\"@Name\"]) == \"Threat Name\"\n    | extend EventData = parse_xml(EventData)\n    | where tostring(ThreatData.[\"#text\"]) has_any (knotweed_sigs));\n  union mde_data, event_data\n  | extend ThreatName = iif(isnotempty(ThreatName), ThreatName, tostring(ThreatData.[\"#text\"]))\n  | extend ThreatFamilyName = iif(isnotempty(ThreatFamilyName), ThreatFamilyName, split(tostring(ThreatData.[\"#text\"]), \"/\")[-1])\n  | extend TimeGenerated = iif(isnotempty(TimeGenerated), TimeGenerated, TimeGenerated1)\n  | extend DeviceName = iif(isnotempty(DeviceName), DeviceName, Computer)\n  | project-reorder TimeGenerated, CompromisedEntity, ThreatName, ThreatFamilyName\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution"
        ],
        "techniques": [
          "T1203"
        ],
        "alertRuleTemplateName": "9f9c1e51-4fb1-4510-a675-c7c2fb32f47e",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "HostName",
                "columnName": "DeviceName"
              }
            ],
            "entityType": "Host"
          }
        ],
        "tags": [
          "KNOTWEED"
        ],
        "status": "Available",
        "templateVersion": "1.0.1",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Legacy IOC based Threat Protection/Analytic Rules/KNOTWEEDAVDetection.yaml"
      }
    }
  ]
}