Threat Detection Content Update - April 2020

[RajasSave]

Summary:

Several changes have been made to the Threat Detection Content in Live. For added detection you need to deploy/download and subscribe to the content via Live, for retired content you'll need to manually remove those.

Detailed configuration procedures for getting RSA NetWitness Platform setup - Content Quick Start Guide 

Additions:

RSA NetWitness Lua Parsers:

• fingerprint_certificate Options - Optional parameters are added to alter the behavior of the fingerprint_certificate parser.
• fingerprint_minidump - Detects Windows Minidump files. Meta will be output as filetype - 'minidump' This parser will also detect minidump files containing lsass memory and output meta as ioc – ‘lsass minidump’

https://community.rsa.com/community/products/netwitness/blog/2020/01/06/using-rsa-netwitness-to-detect-credential-harvesting-lsassy?et=watches.email.blog 

More information about Packet Parsers: https://community.rsa.com/docs/DOC-43422

RSA NetWitness Application Rules:

Following app rules are added to Endpoint Content pack for RSA NetWitness 11.4 Investigation and Alerting –

• Autorun Invalid Signature Windows Directory
• Autorun Unsigned Hidden Only Executable In Directory
• Autorun Unsigned winlogon helper DLL
• Browser Runs Command Prompt
• Command Line Writes Script Files
• Command Prompt Obfuscation
• Command Prompt Obfuscation Using Value Extraction
• Command Shell Copy Items
• Command Shell Runs Rundll32
• Evasive Powershell Used Over Network
• Explorer Public Folder DLL Load
• Hidden and Hooking
• Lateral Movement with Credentials Using Net Utility
• OS Process Runs Command Shell
• Outbound from Unsigned AppData Directory
• Outbound from Windows Directory
• Outbound Unsigned Temporary Directory
• Potential Outlook Exploit
• Powershell Double Base64
• Process Redirects to STDOUT or STDERR
• RDP Launching Loopback Address
• Remote Directory Traversal
• RPM Ownership Changed
• RPM Permissions Changed
• Unsigned Creates Remote Thread And File Hidden
• Unsigned Library in Suspicious Daemon
• Unsigned Opens LSASS
• WMIC Remote Node Activity
• Multiple Psexec Within Short Time

More information about NetWitness 11.4 New Features and Alerting: ESA Rule Types 

Changes:

RSA NetWitness Lua Parsers:

• china_chopper – Functionally has been added to detect new variants of china chopper. 
• DCERPC – Parser now supports NTLM authentication along with Kerberos. Parser will now extract authentication meta from both Kerberos and NTLM

https://community.rsa.com/community/products/netwitness/blog/2020/01/16/using-rsa-netwitness-to-detect-lateral-movement-scshell-dcerpc 

• DynDNS – Parser is updated with improved detection with addition of new dynamic DNS domains detected by RSA Incident Response. 

Read more about threat hunting/investigation using DynDNS parser https://community.rsa.com/community/products/netwitness/blog/2020/03/16/whats-updog 

• fingerprint_certificate - This parser is updated for efficiency improvements as well as added detection with more customization using options file.
• HTTP_lua – Updated for accuracy and efficiency.
• SMB_lua – Functionally has been added to support SMBv3.
• MAIL_lua – Updated for accuracy and efficiency.
• TLS_lua - Added a new option to TLS_lua to limit examination of sessions to only the ports specified in the option. If enabled, ports not listed will not be parsed by TLS_lua and thus will not be identified as service 443. This will reduce the workload of TLS_lua by eliminating identification of SSL/TLS sessions on unknown ports.

Read more about https://community.rsa.com/community/products/netwitness/blog/2016/08/30/ssl-and-netwitness 

• SSH_lua - SSH_lua parser now include SSH Versions for both server and client thus providing better insights in investigation.
• windows_command_shell_lua – Updates are made to base64 encoded command detections along with new commands.
• xor_executable_lua – Improved detection with more xor'd executables by adding detection xor'd MZ header.

RSA NetWitness Application Rules:

Following app rules are updated to Endpoint Content pack for 11.4 Investigation and Alerting –

• Office application injects remote process
• Office Application Runs Scripting Engine
• Creates Remote Service

RSA NetWitness Bundles:

Endpoint Pack has been updated with new and updated content so support Alerting for NetWitness Endpoint 11.4 and higher. 

Refer Endpoint Content for detailed information about content pack and its configuration. 

More content has been tagged with MITRE ATT&CK™ metadata for better coverage and improve detection.

For detailed information about MITRE ATT&CK™:

RSA Threat Content mapping with MITRE ATT&CK™ 

https://community.rsa.com/community/products/netwitness/blog/2020/01/08/manifesting-mitre-attck-metadata-in-rsa-netwitness 

Discontinued:

We strive to provide timely and accurate detection of threats as well as traits that can help analysts hunt through network and log data. Occasionally this means retiring content that provides little-to-no value.

List of Discontinued Content 

RSA NetWitness Application Rules:

• php put with 40x error – Marked discontinued due to performance-to-value tradeoff.
• php botnet beaconing w - Retiring this rule as provides little-to-no value as PHP beaconing has evolved and uses different patterns.
• Windows NTLM Network Logon Successful - Retiring as improved application rule for ‘Pass the Hash’ has been created.

For additional documentation, downloads, and more, visit the RSA NetWitness Platform page on RSA Link.

EOPS Policy:

RSA has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.