sesameop #3827
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| name: Windows Potential AppDomainManager Hijack Artifacts Creation | ||
| id: be19b369-fd0c-42be-ae97-c10b6c01638f | ||
| version: 1 | ||
| date: '2025-12-10' | ||
| author: Teoderick Contreras, Splunk | ||
| status: production | ||
| type: Anomaly | ||
| description: The following analytic detects the creation of an .exe file along with its corresponding .exe.config and a .dll in the same directory, which is a common pattern indicative of potential AppDomain hijacking or CLR code injection attempts. This behavior may signal that a malicious actor is attempting to load a rogue assembly into a legitimate application's AppDomain, allowing code execution under the context of a trusted process. | ||
| data_source: | ||
| - Sysmon EventID 11 | ||
| search: | | ||
| | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime from datamodel=Endpoint.Filesystem | ||
| where Filesystem.file_name IN ("*.exe", "*.exe.config", "*.dll") AND Filesystem.file_path IN | ||
| ("*\\windows\\fonts\\*", "*\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*","*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\PerfLogs\\*") | ||
| AND Filesystem.action = "created" | ||
| by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | ||
| | `drop_dm_object_name("Filesystem")` | ||
| | stats values(file_name) AS file_names | ||
| values(file_path) AS file_paths | ||
| values(user) AS users | ||
| min(firstTime) AS firstTime max(lastTime) AS lastTime | ||
| BY dest process_guid | ||
| | eval exe_present = if(mvcount(mvfilter(match(file_names, "\.exe$"))) > 0, 1, 0) | ||
| | eval config_present = if(mvcount(mvfilter(match(file_names, "\.exe\.config$"))) > 0, 1, 0) | ||
| | eval dll_present = if(mvcount(mvfilter(match(file_names, "\.dll$"))) > 0, 1, 0) | ||
|
|
||
| | eval exe_files = mvfilter(match(file_names, "\.exe$") AND NOT match(file_names, "\.exe\.config$")) | ||
| | eval config_files = mvfilter(match(file_names, "\.exe\.config$")) | ||
| | eval exe_base_names = mvmap(exe_files, replace(exe_files, "\.exe$", "")) | ||
| | eval config_base_names = mvmap(config_files, replace(config_files, "\.exe\.config$", "")) | ||
|
|
||
| | mvexpand exe_base_names | ||
| | mvexpand config_base_names | ||
|
|
||
| | eval file_count = mvcount(file_names) | ||
|
|
||
| | where file_count >= 3 AND exe_present = 1 AND config_present = 1 AND dll_present = 1 AND exe_base_names = config_base_names | ||
| | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)` | ||
| | `windows_potential_appdomainmanager_hijack_artifacts_creation_filter` | ||
| how_to_implement: To successfully implement this search you need to be ingesting information | ||
| on process that include the name of the process responsible for the changes from | ||
| your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, | ||
| confirm the latest CIM App 4.20 or higher is installed and the latest TA for the | ||
| endpoint product. | ||
| known_false_positives: This detection may still produce false positives, so additional filtering is recommended. To validate potential alerts, verify that the executable’s original file name matches its current file name, and also review the associated .config file to confirm which DLLs are expected to load during execution. This helps distinguish legitimate activity from suspicious behavior. | ||
| references: | ||
| - https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/ | ||
| - https://attack.mitre.org/techniques/T1574/014/ | ||
tccontre marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - https://gist.github.com/djhohnstein/afb93a114b848e16facf0b98cd7cb57b | ||
| - https://www.scworld.com/brief/appdomain-manager-injection-exploited-for-cobalt-strike-beacon-delivery | ||
| - https://jp.security.ntt/insights_resources/tech_blog/appdomainmanager-injection-en/ | ||
| drilldown_searches: | ||
| - name: View the detection results for - "$dest$" | ||
| search: '%original_detection_search% | search dest = "$dest$"' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| - name: View risk events for the last 7 days for - "$dest$" | ||
| search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | ||
| starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime | ||
| values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) | ||
| as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) | ||
| as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)`' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| rba: | ||
| message: A file $file_name$ is created in $file_path$ on $dest$ | ||
|
Contributor
There was a problem hiding this comment. @ljstella same question here. If the condition is grouping the file name into MVs. What's best to use here? Should we perhaps use
Contributor
There was a problem hiding this comment. Nas, multi value fields do not have the best interpretation when it comes to risk_message. I enabled this detection as is on Endor and you can check out how the risk event looks using this query : you can either use file_name or file_names and it would show up in with those field_names in the risk index but I tend to like using the CIM field name - file_name and file_path so that this generated risk event has CIM complaint field names that can be leveraged downstream. For this detection, there are 3 files_names and 3 file_paths that get created as threat_objects as a part of a single risk event.
Contributor
There was a problem hiding this comment. when you agree with using CIM field names here, i can make this change and I think we should remove these multi value field names from the risk_message variable which would perhaps give the best UI experience.
Contributor
There was a problem hiding this comment. I agree on using CIM generally but I think there could be issues. First file_name is not part of the output of the detection, and second which file_name entry will be used or will all entries matched by the original condition be listed? |
||
| risk_objects: | ||
| - field: dest | ||
| type: system | ||
| score: 20 | ||
| threat_objects: | ||
| - field: file_names | ||
| type: file_name | ||
|
Comment on lines
+74
to
+75
Contributor
There was a problem hiding this comment. @ljstella question for you. How do multi value threat objects show up? |
||
| - field: file_paths | ||
| type: file_path | ||
| tags: | ||
| analytic_story: | ||
| - SesameOp | ||
| asset_type: Endpoint | ||
| mitre_attack_id: | ||
| - T1574.014 | ||
| product: | ||
| - Splunk Enterprise | ||
| - Splunk Enterprise Security | ||
| - Splunk Cloud | ||
| security_domain: endpoint | ||
| tests: | ||
| - name: True Positive Test | ||
| attack_data: | ||
| - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack.log | ||
| source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational | ||
| sourcetype: XmlWinEventLog | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| name: PromptFlux | ||
| id: e5a8476a-5c58-4da6-8b27-6e18690cca37 | ||
| version: 1 | ||
| date: '2025-12-17' | ||
| author: Teoderick Contreras, Splunk | ||
| status: production | ||
| description: PromptFlux is a POC malware sample that abuses Gemini-like services for command-and-control operations. It achieves persistence by dropping executables or scripts in startup folders and frequently accesses the Gemini API using hard-coded keys or unauthorized requests, often from non-standard processes. The malware also stages payloads, configuration files, or encrypted prompts in temporary directories such as TMP, leaving forensic artifacts. Detection involves monitoring these locations, tracking anomalous API calls, and observing unusual outbound traffic or process injections, enabling early identification and mitigation. | ||
| narrative: PromptFlux is currently a POC malware sample that abuses Gemini-like services for malicious command execution. It ensures persistence by dropping files in startup folders and staging payloads in temporary directories. The malware exploits Gemini API access to receive instructions or exfiltrate data, often using hard-coded keys or unauthorized requests. Its activity may include unusual outbound traffic, process injections, and script execution outside normal workflows. Monitoring these locations and API usage can help identify infections early and prevent further compromise. | ||
| references: | ||
| - https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools | ||
| tags: | ||
| category: | ||
| - Adversary Tactics | ||
| product: | ||
| - Splunk Enterprise | ||
| - Splunk Enterprise Security | ||
| - Splunk Cloud | ||
| usecase: Advanced Threat Detection |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.