diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 98ee2d736a..3d150e6206 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -50,6 +50,8 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 + with: + ref: develop @@ -137,6 +139,8 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 + with: + ref: develop - name: Download artifacts uses: actions/download-artifact@v2 @@ -194,6 +198,8 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 + with: + ref: develop - name: Download artifacts uses: actions/download-artifact@v2 diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 65dece8106..f778569c34 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -8,7 +8,7 @@ datamodel: [] description: This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure - | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod + | stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml new file mode 100644 index 0000000000..27ee132288 --- /dev/null +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -0,0 +1,62 @@ +name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser +id: 114c6bfe-9406-11ec-bcce-acde48001122 +version: 1 +date: '2022-02-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` + is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. + As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser + allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ + Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. +search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes. +references: +- https://attack.mitre.org/techniques/T1558/004/ +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 60 + confidence: 90 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$ \ No newline at end of file diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml new file mode 100644 index 0000000000..37adc01659 --- /dev/null +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -0,0 +1,58 @@ +name: Disabled Kerberos Pre-Authentication Discovery With PowerView +id: b0b34e2c-90de-11ec-baeb-acde48001122 +version: 1 +date: '2022-02-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` + is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. + As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` + allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ + Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. +search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use PowerView for troubleshooting +references: +- https://attack.mitre.org/techniques/T1558/004/ +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 60 + confidence: 90 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$ \ No newline at end of file diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index d86049b7dc..9669c84655 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -40,6 +40,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - IcedID + - Living Off The Land automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index 31e7e9cd42..986e23feaf 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -1,8 +1,8 @@ name: Excessive number of distinct processes created in Windows Temp folder id: 23587b6a-c479-11eb-b671-acde48001122 -version: 1 -date: '2021-06-03' -author: Michael Hart, Splunk +version: 2 +date: '2022-02-28' +author: Michael Hart, Mauricio Velazco, Splunk type: Anomaly datamodel: - Endpoint @@ -13,7 +13,7 @@ description: This analytic will identify suspicious series of process executions to typical application behaviors that use Windows\Temp. search: '| tstats `security_content_summariesonly` values(Processes.process) as process distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter`' diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 70038db580..d1379ef8d1 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -1,26 +1,30 @@ name: Kerberoasting spn request with RC4 encryption id: 5cc67381-44fa-4111-8a37-7a230943f027 -version: 3 -date: '2020-10-16' -author: Jose Hernandez, Patrick Bareiss, Splunk +version: 4 +date: '2022-02-09' +author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk type: TTP datamodel: [] -description: This search detects a potential kerberoasting attack via service principal - name requests -search: '`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17 +description: The following analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack + against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and + attempt to crack them offline allowing them to obtain privileged access to the domain. This analytic looks for a specific combination of the Ticket_Options field + based on common kerberoasting tools. Defenders should be aware that it may be possible for a Kerberoast attack to use different Ticket_Options. +search: '`wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17 | stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kerberoasting_spn_request_with_rc4_encryption_filter`' -how_to_implement: You must be ingesting endpoint data that tracks process activity, - and include the windows security event logs that contain kerberos -known_false_positives: Older systems that support kerberos RC4 by default NetApp may - generate false positives +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: Older systems that support kerberos RC4 by default like NetApp may + generate false positives. Filter as needed references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity tags: analytic_story: - Windows Privilege Escalation + - Active Directory Kerberos Attacks asset_type: Endpoint automated_detection_testing: passed cis20: @@ -31,15 +35,15 @@ tags: - Source:Endpoint - Stage:Credential Access dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log impact: 90 kill_chain_phases: - Privilege Escalation message: Potential kerberoasting attack via service principal name requests detected on $dest$ mitre_attack_id: - - T1558.003 - T1558 + - T1558.003 nist: - DE.CM observable: diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml new file mode 100644 index 0000000000..3764b64382 --- /dev/null +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -0,0 +1,59 @@ +name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl +id: 0cb847ee-9423-11ec-b2df-acde48001122 +version: 1 +date: '2022-02-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic leverages Windows Security Event 4738, `A user account was changed`, + to identify a change performed on a domain user object that disables Kerberos Pre-Authentication. + Disabling the Pre Authentication flag in the UserAccountControl property allows an adversary to easily perform a brute + force attack against the user's password offline leveraging the ASP REP Roasting technique. + Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor + or a way to escalate privileges. +search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require Preauth'' - Enabled*" +| table EventCode, Account_Name, Security_ID, MSADChangedAttributes +| `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting + `User Account Management` within `Account Management` needs to be enabled. +known_false_positives: Unknown. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log + kill_chain_phases: + - Intrusion + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Account_Name + - Security_ID + - MSADChangedAttributes + security_domain: endpoint + impact: 50 + confidence: 90 + risk_score: 45 + context: + - Source:Endpoint + - Stage:PrivilegeEscalation + - Stage:Persistence + message: Kerberos Pre Authentication was Disabled for $Account_Name$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml new file mode 100644 index 0000000000..18446fda3a --- /dev/null +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml @@ -0,0 +1,57 @@ +name: Kerberos Pre-Authentication Flag Disabled with PowerShell +id: 59b51620-94c9-11ec-b3d5-acde48001122 +version: 1 +date: '2022-02-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Set-ADAccountControl` commandlet with specific parameters. `Set-ADAccountControl` + is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. + As the name suggests, `Set-ADAccountControl` is used to modify User Account Control values for an Active Directory domain account. + With the appropiate parameters, Set-ADAccountControl allows adversaries to disable Kerberos Pre-Authentication for an account to + to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique. + Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor + or a way to escalate privileges. +search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Although unlikely, Administrators may need to set this flag for legitimate purposes. +references: +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log + kill_chain_phases: + - Intrusion + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 50 + confidence: 90 + risk_score: 45 + context: + - Source:Endpoint + - Stage:PrivilegeEscalation + - Stage:Persistence + message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml new file mode 100644 index 0000000000..448da5f4e2 --- /dev/null +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -0,0 +1,70 @@ +name: Mimikatz PassTheTicket CommandLine Parameters +id: 13bbd574-83ac-11ec-99d4-acde48001122 +version: 1 +date: '2022-02-01' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. + Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. + Defenders should be aware that adversaries may customize the source code of Mimikatz and modify the command line parameters. This would effectively bypass this analytic. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets /export*" + OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz. +references: +- https://github.com/gentilkiwi/mimikatz +- https://attack.mitre.org/techniques/T1550/003/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1550 + - T1550.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:PrivilegeEscalation + message: Mimikatz command line parameters for pass the ticket attacks were used on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index 8e60ca1557..7448859a68 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - Active Directory Password Spraying + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index 3612834bee..135b96420c 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - Active Directory Password Spraying + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 2cc0ffadc0..5ebf02b7cc 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -44,6 +44,7 @@ references: tags: analytic_story: - Active Directory Password Spraying + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 70 context: diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml new file mode 100644 index 0000000000..49b18089a9 --- /dev/null +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -0,0 +1,78 @@ +name: Rubeus Command Line Parameters +id: cca37478-8377-11ec-b59a-acde48001122 +version: 1 +date: '2022-02-01' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs + MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized in common Kerberos attacks like exporting and importing tickets, + forging silver and golden tickets, requesting a TGT or TGS, kerberoasting, password spraying, etc. Red teams and adversaries alike use Rubeus for Kerberos attacks within Active Directory networks. + Defenders should be aware that adversaries may customize the source code of Rubeus and modify the command line parameters. This would effectively bypass this analytic. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*" + OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR Processes.process ="* asktgs* /service:*" + OR Processes.process ="* golden* /user:*" OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" + OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*" + OR Processes.process = "* brute* /passwords:*" OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed. +references: +- https://github.com/GhostPack/Rubeus +- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ +- https://attack.mitre.org/techniques/T1550/003/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1550 + - T1550.003 + - T1558 + - T1558.003 + - T1558.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: Rubeus command line parameters were used on $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml new file mode 100644 index 0000000000..e2bc4817d8 --- /dev/null +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -0,0 +1,71 @@ +name: Rubeus Kerberos Ticket Exports Through Winlogon Access +id: 5ed8c50a-8869-11ec-876f-acde48001122 +version: 1 +date: '2022-02-07' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic looks for a process accessing the winlogon.exe system process. The Splunk Threat Research team identified this behavior + when using the Rubeus tool to monitor for and export kerberos tickets from memory. Before being able to export tickets. Rubeus will try to escalate privileges to SYSTEM by + obtaining a handle to winlogon.exe before trying to monitor for kerberos tickets. Exporting tickets from memory is typically the first step for pass the ticket attacks. + Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. + Defenders should be aware that adversaries may customize the source code of Rubeus to potentially bypass this analytic. +search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) + (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND + SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND + SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, + SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename + Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' +how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which + includes EventCode 10. This search uses an input macro named `sysmon`. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition + with configurations for your Splunk environment. +known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed +references: +- https://github.com/GhostPack/Rubeus +- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ +- https://attack.mitre.org/techniques/T1550/003/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + kill_chain_phases: + - Privilege Escalation + - Lateral Movement + mitre_attack_id: + - T1550 + - T1550.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - TargetImage + - CallTrace + - Computer + - TargetProcessId + - SourceImage + - SourceProcessId + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: Winlogon.exe was accessed by $SourceImage$ on $dest$ + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: TargetImage + type: Process + role: + - Target diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index ea52e4a955..63098b3965 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -48,6 +48,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 916f0a8054..8e3be8fa03 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -56,6 +56,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Active Directory Kerberos Attacks automated_detection_testing: passed confidence: 100 context: @@ -66,6 +67,7 @@ tags: impact: 80 kill_chain_phases: - Privilege Escalation + - Active Directory Kerberos Attacks message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. mitre_attack_id: diff --git a/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml new file mode 100644 index 0000000000..1d87d7bca4 --- /dev/null +++ b/detections/endpoint/ssa___windows_eventvwr_uac_bypass.yml @@ -0,0 +1,63 @@ +name: Windows Eventvwr UAC Bypass +id: 66adff66-90d9-11ec-aba7-acde48001122 +version: 1 +date: '2022-02-18' +author: Lou Stella, Splunk +type: Anomaly +datamodel: +- Endpoint_Registry +description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed upon eventvwr.msc loading. Upon triage, review the parallel processes that have executed. Identify any additional registry modifications on the endpoint that may look suspicious. Remediate as necessary. +search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND (like (registry_path, "%mscfile\\\\shell\\\\open\\\\command%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel. +known_false_positives: None known at this time. +references: +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md +- https://attack.mitre.org/techniques/T1548/002 +- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - IcedID + - Living Off The Land + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.002 + - T1548 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - event_id + - registry_path + - registry_hive + - registry_value_name + - registry_key_name + - registry_value_type + - registry_value_data + - process_guid + security_domain: endpoint + impact: 80 + confidence: 100 + risk_score: 80 + risk_severity: high + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: Registry values were modified to bypass UAC using Event Viewer on $dest_device_id$ + observable: + - name: dest_device_id + type: Hostname + role: + - Victim + - name: dest_user_id + type: User + role: + - Victim + nist: + - DE.AE + cis20: + - CIS 14 \ No newline at end of file diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml new file mode 100644 index 0000000000..1a03a880dc --- /dev/null +++ b/detections/endpoint/suspicious_linux_discovery_commands.yml @@ -0,0 +1,59 @@ +name: Suspicious Linux Discovery Commands +id: 0edd5112-56c9-11ec-b990-acde48001122 +version: 1 +date: '2021-12-06' +author: Bhavin Patel, Splunk +type: TTP +datamodel: +- Endpoint +description: This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, executables and file permissions on a Linux host.\ + + The search logic specifically looks for high number of distinct commands run in a short period of time. +search: '| tstats `security_content_summariesonly` count values(Processes.process) values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where [|inputlookup linux_tool_discovery_process.csv | rename process as Processes.process |table Processes.process] by _time span=5m Processes.user Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)`| where distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`' +how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). + Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment. +known_false_positives: Unless an administrator is using these commands to troubleshoot + or audit a system, the execution of these commands should be monitored. +references: +- https://attack.mitre.org/matrices/enterprise/linux/ +- https://attack.mitre.org/techniques/T1059/004/ +- https://github.com/IvanGlinkin/AutoSUID +- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS +- https://github.com/rebootuser/LinEnum +tags: + analytic_story: + - Linux Post-Exploitation + automated_detection_testing: passed + confidence: 90 + context: + - Source:Endpoint + - Stage:Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log + impact: 90 + kill_chain_phases: + - Exploitation + message: Suspicious Linux Discovery Commands detected on $dest$ + mitre_attack_id: + - T1059.004 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.parent_process_name + - Processes.user + - Processes.process_name + risk_score: 81 + security_domain: endpoint diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml new file mode 100644 index 0000000000..dbafa42be0 --- /dev/null +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -0,0 +1,68 @@ +name: Unusual Number of Kerberos Service Tickets Requested +id: eb3e6702-8936-11ec-98fe-acde48001122 +version: 1 +date: '2022-02-08' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: The following hunting analytic leverages Kerberos Event 4769, A Kerberos service ticket was requested, to identify a potential kerberoasting attack + against Active Directory networks. Kerberoasting allows an adversary to request kerberos tickets for domain accounts typically used as service accounts and + attempt to crack them offline allowing them to obtain privileged access to the domain.\ + + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number service ticket requests. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. +search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17 +| bucket span=2m _time +| stats dc(Service_Name) AS unique_services values(Service_Name) as requested_services by _time, Client_Address +| eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0) +| search isOutlier=1 +| `unusual_number_of_kerberos_service_tickets_requested_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: An single endpoint requesting a large number of kerberos service + tickets is not common behavior. Possible false positive scenarios include but are + not limited to vulnerability scanners, administration systems and missconfigured + systems. +references: +- https://attack.mitre.org/techniques/T1558/003/ +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting +tags: + analytic_story: + - Active Directory Kerberos Attacks + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1558 + - T1558.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Ticket_Options + - Ticket_Encryption_Type + - dest + - Service_Name + - service_id + - Client_Address + security_domain: endpoint + impact: 60 + confidence: 60 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: + observable: + - name: Client_Address + type: Endpoint + role: + - Victim diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index b422b0def9..f58b522cbe 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Living Off The Land confidence: 90 context: - Source:Endpoint diff --git a/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml new file mode 100644 index 0000000000..68f37f6895 --- /dev/null +++ b/detections/experimental/endpoint/ssa___windows_wsreset_uac_bypass.yml @@ -0,0 +1,56 @@ +name: Windows WSReset UAC Bypass +id: 3118f0c2-90d9-11ec-b833-acde48001122 +version: 1 +date: '2022-02-18' +author: Lou Stella, Splunk +type: Anomaly +datamodel: +- Endpoint_Registry +description: This analytic is built to detect a suspicious modification of the Windows registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User Account Control. +search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels) | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)), registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)), registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"), "string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"), "string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"), "string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"), "string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%") AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive", registry_hive, "registry_value_name", registry_value_name, "registry_key_name", registry_key_name, "registry_value_type", registry_value_type, "registry_value_data", registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); ' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Registry` datamodel. +known_false_positives: Unknown at this point in time. +references: +- https://github.com/hfiref0x/UACME +- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass +tags: + analytic_story: + - Living Off The Land + - Windows Defense Evasion Tactics + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1548.002 + - T1548 + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - registry_path + - registry_hive + - registry_value_name + - registry_key_name + - registry_value_type + - registry_value_data + - process_guid + security_domain: endpoint + impact: 70 + confidence: 90 + risk_score: 63 + risk_severity: medium + context: + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Incoming + message: + observable: + - name: dest + type: Hostname + role: + - Victim + nist: + - DE.AE + cis20: + - CIS 14 \ No newline at end of file diff --git a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml index d0260a789b..90af130e1a 100644 --- a/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml +++ b/detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml @@ -6,33 +6,37 @@ author: Xiao Lin, Splunk type: Anomaly datamodel: - Network_Traffic -description: Insider might conduct information collection before data exfiltration, - and unusual volume of data download from internal server is an indicator of such - potential threat. This detection evaluates the total bytes downloaded from internal - servers at specific time window per entity level, and then flagged these that are - higher than 99.999% percentile as an anamaly. A behavior will be reported as long - as the downloaded byte volume is unusual even though that operation is benigh, which - causes false positive. It is therefore advised to adjust threshold and time window - based on detection performance whenever necessary. It should be noted that seasonality - is not modeled in the current approach. -search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event, - "sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event, - "_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope - = map_get(input_event, "src_device_scope") | eval dest_device_scope = map_get(input_event, - "src_device_scope") | where src_device_scope IS NOT NULL AND dest_device_scope IS - NOT NULL | eval dest_device = map_get(input_event, "dest_device_ips") | where dest_device - IS NOT NULL AND dest_device_scope == "INTERNAL" | eval src_device = map_get(input_event, - "source_device_ips") | where src_device IS NOT NULL AND src_device_scope == "INTERNAL" - | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string", - null)) | where download_bytes IS NOT NULL | eval tenant = map_get(input_event, "_tenant"), - event_id = map_get(input_event, "event_id") | adaptive_threshold algorithm="quantile" - value="download_bytes" entity="dest_device" threshold=0.001 window=86400L | eval - end_time = timestamp | eval start_time = end_time - 86400 | eval body = create_map(["event_id", - event_id, "tenant", tenant]) | select start_time, end_time, dest_device, label, - body | into write_ssa_detected_events();' -how_to_implement: Ingest PAN traffic logs -known_false_positives: Benign large volume data download might be flagged as (false) - positive. +description: Insider might conduct information collection before data exfiltration, and unusual volume of data + download from internal server is an indicator of such potential threat. This detection evaluates the total + bytes downloaded from internal servers at specific time window per entity level, and then flagged these that + are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte + volume is unusual even though that operation is benign, which causes false positive. It is therefore advised + to adjust threshold and time window based on detection performance whenever necessary. It should be noted that + seasonality is not modeled in the current approach. +search: '| from read_ssa_enriched_events() + | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null) + | eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null)) + | where sourcetype == "pan:traffic" + | eval src_device_scope =ucast(map_get(input_event, "src_device_scope"), "string", null) + | eval dest_device_scope=ucast(map_get(input_event, "dest_device_scope"), "string", null) + | where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL + | eval dest_device = ucast(map_get(input_event, "dest_device_ips"), "collection", [])[0] + | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL" + | eval src_device = ucast(map_get(input_event, "src_device_ips"), "collection", [])[0] + | where src_device IS NOT NULL AND src_device_scope == "INTERNAL" + | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer", 0) + | eval download_bytes = cast(bytes_in, "double") + | eval tenant = ucast(map_get(input_event, "_tenant"), "string", null) + | eval event_id = ucast(map_get(input_event, "event_id"), "string", null) + | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" window=86400000L + | where label AND quantile>0.99999 + | eval end_time = timestamp + | eval start_time = end_time - 86400000 + | eval body = create_map(["event_id", event_id, "tenant", tenant]) + | eval entities=mvappend(dest_device) + | into write_ssa_detected_events();' +how_to_implement: Ingest PAN traffic logs +known_false_positives: Benign large volume data download might be flagged as (false) positive. references: - https://github.com/twitter/AnomalyDetection tags: diff --git a/lookups/linux_tool_discovery_process.csv b/lookups/linux_tool_discovery_process.csv new file mode 100644 index 0000000000..98b55d4efc --- /dev/null +++ b/lookups/linux_tool_discovery_process.csv @@ -0,0 +1,61 @@ +process +cat /proc/version +cat /etc/*-release +/etc/passwd +cat /etc/* +lastlog +id +PermitRootLogin +sestatus * +ps +mysql* +netstat* +find * +head /var/mail/root +docker +cat /etc/issue +cat /etc/*-release +cat /proc/version +uname -a +uname -mrs +rpm -q kernel +dmesg | grep Linux +ls /boot | grep vmlinuz- +cat /etc/profile +cat /etc/bashrc +cat ~/.bash_profile +cat ~/.bashrc +cat ~/.bash_logout +ps -aux | grep root +ps -ef | grep root +crontab -l +cat /etc/cron* +cat /etc/cron.allow +cat /etc/cron.deny +cat /etc/crontab +grep -i user * +grep -i pass * +ifconfig +cat /etc/network/interfaces +cat /etc/sysconfig/network +cat /etc/resolv.conf +cat /etc/networks +cvelist-file:* +exploit-db* +strings -e /etc/apache2/apache2.conf +strings -e /etc/ssh/sshd_config +strings -e /etc/shadow +iptables -L +lsof -i +netstat -antup +netstat -antpx +netstat -tulpn +arp -e +route +cat /etc/passwd +cat /etc/group +cat /etc/shadow +find / -perm -u=s +find / -perm -g=s +find / -perm -4000 +find / -perm -2000 \ No newline at end of file diff --git a/lookups/linux_tool_discovery_process.yml b/lookups/linux_tool_discovery_process.yml new file mode 100644 index 0000000000..645544a521 --- /dev/null +++ b/lookups/linux_tool_discovery_process.yml @@ -0,0 +1,7 @@ +description: A list of suspicious bash commonly used by attackers via scripts +filename: linux_tool_discovery_process.csv +name: linux_tool_discovery_process +default_match: 'false' +match_type: WILDCARD(process) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index abe2c6ca7c..7ff10c3a45 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -28,7 +28,6 @@ Extensions,Name .bitstak,BitStak .Silent,BlackShades Crypter .blocatto,Blocatto -.lock,Brazilian .cry,Central Security Treatment Organization .cerber,Cerber .cerber2,Cerber @@ -299,4 +298,4 @@ Extensions,Name .FUSION,Fusion .MILIHPEN,Milihpen .GANGBANG,Gangbang -.reddot,RedDot \ No newline at end of file +.reddot,RedDot diff --git a/playbooks/activedirectory_reset_password.yml b/playbooks/activedirectory_reset_password.yml index 93bf24ddb3..0586ae5076 100644 --- a/playbooks/activedirectory_reset_password.yml +++ b/playbooks/activedirectory_reset_password.yml @@ -12,6 +12,7 @@ app_list: - "LDAP" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - compromisedUserName product: diff --git a/playbooks/aws_disable_user_accounts.yml b/playbooks/aws_disable_user_accounts.yml index c09f103fed..de055065f7 100644 --- a/playbooks/aws_disable_user_accounts.yml +++ b/playbooks/aws_disable_user_accounts.yml @@ -14,6 +14,7 @@ app_list: tags: platform_tags: - Cloud + playbook_type: Input playbook_fields: - aws_username product: diff --git a/playbooks/aws_find_inactive_users.yml b/playbooks/aws_find_inactive_users.yml index 7e0fabfdc3..37580b6093 100644 --- a/playbooks/aws_find_inactive_users.yml +++ b/playbooks/aws_find_inactive_users.yml @@ -15,6 +15,7 @@ app_list: tags: platform_tags: - Cloud + playbook_type: Automation playbook_fields: [] product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/block_indicators.yml b/playbooks/block_indicators.yml index b1686ff23d..bd50121ece 100644 --- a/playbooks/block_indicators.yml +++ b/playbooks/block_indicators.yml @@ -14,6 +14,7 @@ app_list: - "OpenDNS Umbrella" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - destinationDnsDomain - destinationAddress diff --git a/playbooks/crowdstrike_malware_triage.yml b/playbooks/crowdstrike_malware_triage.yml index 292b830119..eef531f13f 100644 --- a/playbooks/crowdstrike_malware_triage.yml +++ b/playbooks/crowdstrike_malware_triage.yml @@ -12,6 +12,7 @@ app_list: - "Crowdstrike OAuth" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - filePath - destinationAddress diff --git a/playbooks/custom_functions/container_merge.json b/playbooks/custom_functions/container_merge.json index 9ea4df87bc..c6ac131e42 100644 --- a/playbooks/custom_functions/container_merge.json +++ b/playbooks/custom_functions/container_merge.json @@ -1,6 +1,6 @@ { - "create_time": "2021-10-18T12:31:32.500833+00:00", - "custom_function_id": "83776ecf4dd52c71d8497cb500dd332780eb9c72", + "create_time": "2022-02-25T14:52:47.172543+00:00", + "custom_function_id": "1f8ae8e7978b750272fbbaba5efe4e6127a9a6a7", "description": "An alternative to the add-to-case API call. This function will copy all artifacts, automation, notes and comments over from every container within the container_list into the target_container. The target_container will be upgraded to a case.\n\nThe notes will be copied over with references to the child containers from where they came. A note will be left in the child containers with a link to the target container. The child containers will be marked as evidence within the target container. \n\nAny notes left as a consequence of the merge process will be skipped in subsequent merges.", "draft_mode": false, "inputs": [ @@ -36,6 +36,6 @@ } ], "outputs": [], - "platform_version": "5.0.1.66250", + "platform_version": "5.2.1.78411", "python_version": "3" } \ No newline at end of file diff --git a/playbooks/custom_functions/container_merge.py b/playbooks/custom_functions/container_merge.py index c301bbb310..49cbcce3bf 100644 --- a/playbooks/custom_functions/container_merge.py +++ b/playbooks/custom_functions/container_merge.py @@ -162,7 +162,7 @@ def container_merge(target_container=None, container_list=None, workbook=None, c # Fetch any previous merge note params = {'_filter_container': '"{}"'.format(container['id']), '_filter_title': '"[Auto-Generated] Child Containers"'} note_url = phantom.build_phantom_rest_url('note') - response_data = phantom.requests.get(note_url, verify=False).json() + response_data = phantom.requests.get(note_url, params=params, verify=False).json() # If an old note was found, proceed to overwrite it if response_data['count'] > 0: note_item = response_data['data'][0] diff --git a/playbooks/custom_functions/find_related_containers.json b/playbooks/custom_functions/find_related_containers.json index 1ae234becf..30aeb111f7 100644 --- a/playbooks/custom_functions/find_related_containers.json +++ b/playbooks/custom_functions/find_related_containers.json @@ -1,6 +1,6 @@ { - "create_time": "2021-10-07T15:52:23.940165+00:00", - "custom_function_id": "24c4ef5ecd259674a07cd3c747f4223f09b5dd8f", + "create_time": "2022-02-10T18:24:50.244936+00:00", + "custom_function_id": "5781e3d5a4773b2c48afd429768fd81b5e733e54", "description": "Takes a provided list of indicator values to search for and finds all related containers. It will produce a list of the related container details.", "draft_mode": false, "inputs": [ @@ -113,6 +113,6 @@ "description": "Link to container" } ], - "platform_version": "5.0.1.66250", + "platform_version": "5.2.1.78411", "python_version": "3" } \ No newline at end of file diff --git a/playbooks/custom_functions/find_related_containers.py b/playbooks/custom_functions/find_related_containers.py index 749842d4dd..4fd6bea923 100644 --- a/playbooks/custom_functions/find_related_containers.py +++ b/playbooks/custom_functions/find_related_containers.py @@ -96,7 +96,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container filter_in_case = True # If value list is equal to * then proceed to grab all indicator records for the current container - if isinstance(value_list, list) and value_list[0] == "*": + if value_list and (isinstance(value_list, list) and "*" in value_list) or (isinstance(value_list, str) and value_list == "*"): new_value_list = [] url = phantom.build_phantom_rest_url('container', current_container, 'artifacts') + '?page_size=0' response_data = phantom.requests.get(uri=url, verify=False).json().get('data') @@ -127,15 +127,10 @@ def find_related_containers(value_list=None, minimum_match_count=None, container for indicator_id in list(set(indicator_id_list)): params = {'indicator_ids': indicator_id} response_data = phantom.requests.get(indicator_common_container_url, params=params, verify=False).json() + # Populate an indicator dictionary where the original ids are the dictionary keys and the # associated continers are the values if response_data: - # Quit early if no related containers were found - if len(response_data) == 1 and response_data[0].get('container_id') == current_container: - phantom.debug(f"No related containers found for provided values: '{value_list}'") - assert json.dumps(outputs) # Will raise an exception if the :outputs: object is not JSON-serializable - return outputs - indicator_id_dictionary[str(indicator_id)] = [] for item in response_data: # Append all related containers except for current container @@ -167,8 +162,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container # Gather container data params = {'page_size': 0} - if offset_time: - params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"' + params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"' containers_response = phantom.requests.get(uri=container_url, params=params, verify=False).json() all_container_dictionary = {} if containers_response['count'] > 0: diff --git a/playbooks/delete_detected_files.yml b/playbooks/delete_detected_files.yml index 3e41aae6f5..f97a071ab6 100644 --- a/playbooks/delete_detected_files.yml +++ b/playbooks/delete_detected_files.yml @@ -16,6 +16,7 @@ tags: detections: - Executable File Written in Administrative SMB Share platform_tags: [] + playbook_type: Automation playbook_fields: - filePath - destinationAddress diff --git a/playbooks/email_notification_for_malware.yml b/playbooks/email_notification_for_malware.yml index 6afbc2d9f8..5327b71a32 100644 --- a/playbooks/email_notification_for_malware.yml +++ b/playbooks/email_notification_for_malware.yml @@ -15,6 +15,7 @@ app_list: - "SMTP" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - fileHash - vaultId diff --git a/playbooks/internal_host_splunk_investigate_log4j.yml b/playbooks/internal_host_splunk_investigate_log4j.yml index 59c4fec939..17074df9e5 100644 --- a/playbooks/internal_host_splunk_investigate_log4j.yml +++ b/playbooks/internal_host_splunk_investigate_log4j.yml @@ -15,6 +15,7 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 platform_tags: [] + playbook_type: Input playbook_fields: - hostName - destinationAddress diff --git a/playbooks/internal_host_ssh_investigate.yml b/playbooks/internal_host_ssh_investigate.yml index 0604c74c52..a76aaa0521 100644 --- a/playbooks/internal_host_ssh_investigate.yml +++ b/playbooks/internal_host_ssh_investigate.yml @@ -12,6 +12,7 @@ app_list: - "SSH" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_ssh_log4j_investigate.yml b/playbooks/internal_host_ssh_log4j_investigate.yml index 8d63eb9780..ab59dfeb03 100644 --- a/playbooks/internal_host_ssh_log4j_investigate.yml +++ b/playbooks/internal_host_ssh_log4j_investigate.yml @@ -12,6 +12,7 @@ app_list: - "SSH" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_ssh_log4j_respond.yml b/playbooks/internal_host_ssh_log4j_respond.yml index e42634649b..8a529055fc 100644 --- a/playbooks/internal_host_ssh_log4j_respond.yml +++ b/playbooks/internal_host_ssh_log4j_respond.yml @@ -12,6 +12,7 @@ app_list: - "SSH" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_investigate.yml b/playbooks/internal_host_winrm_investigate.yml index 8db5966975..7fdc684799 100644 --- a/playbooks/internal_host_winrm_investigate.yml +++ b/playbooks/internal_host_winrm_investigate.yml @@ -12,6 +12,7 @@ app_list: - "Windows Remote Management" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_log4j_investigate.yml b/playbooks/internal_host_winrm_log4j_investigate.yml index d90fc2c6f8..6252cd96ae 100644 --- a/playbooks/internal_host_winrm_log4j_investigate.yml +++ b/playbooks/internal_host_winrm_log4j_investigate.yml @@ -12,6 +12,7 @@ app_list: - "Windows Remote Management" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/internal_host_winrm_log4j_respond.yml b/playbooks/internal_host_winrm_log4j_respond.yml index 1987ff3685..8341080187 100644 --- a/playbooks/internal_host_winrm_log4j_respond.yml +++ b/playbooks/internal_host_winrm_log4j_respond.yml @@ -12,6 +12,7 @@ app_list: - "Windows Remote Management" tags: platform_tags: [] + playbook_type: Input playbook_fields: [] product: - Splunk SOAR diff --git a/playbooks/log4j_investigate.yml b/playbooks/log4j_investigate.yml index 01d648e0a4..25e7e6c816 100644 --- a/playbooks/log4j_investigate.yml +++ b/playbooks/log4j_investigate.yml @@ -30,5 +30,6 @@ tags: - Log4Shell JNDI Payload Injection with Outbound Connection - Detect Outbound LDAP Traffic playbook_fields: [] + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/log4j_respond.yml b/playbooks/log4j_respond.yml index ddbb3e6c45..15bd0a34d2 100644 --- a/playbooks/log4j_respond.yml +++ b/playbooks/log4j_respond.yml @@ -30,5 +30,6 @@ tags: - Log4Shell JNDI Payload Injection with Outbound Connection - Detect Outbound LDAP Traffic playbook_fields: [] + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/malware_hunt_and_contain.yml b/playbooks/malware_hunt_and_contain.yml index 9d60cffa84..8b0e78dfe3 100644 --- a/playbooks/malware_hunt_and_contain.yml +++ b/playbooks/malware_hunt_and_contain.yml @@ -15,6 +15,7 @@ app_list: - "VirusTotal" tags: platform_tags: [] + playbook_type: Automation playbook_fields: - fileHash product: diff --git a/playbooks/ransomware_investigate_and_contain.yml b/playbooks/ransomware_investigate_and_contain.yml index 49aaebbb68..13e3766a3a 100644 --- a/playbooks/ransomware_investigate_and_contain.yml +++ b/playbooks/ransomware_investigate_and_contain.yml @@ -22,6 +22,7 @@ tags: - Conti Common Exec parameter platform_tags: - Ransomware + playbook_type: Automation playbook_fields: - ComputerName - Username diff --git a/playbooks/risk_notable_block_indicators.yml b/playbooks/risk_notable_block_indicators.yml index 6edafdbfac..836ae15d21 100644 --- a/playbooks/risk_notable_block_indicators.yml +++ b/playbooks/risk_notable_block_indicators.yml @@ -18,6 +18,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_enrich.yml b/playbooks/risk_notable_enrich.yml index 0b1b6a260e..cc9e59cf7b 100644 --- a/playbooks/risk_notable_enrich.yml +++ b/playbooks/risk_notable_enrich.yml @@ -17,6 +17,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_import_data.yml b/playbooks/risk_notable_import_data.yml index 6fd5db62bf..352f9ed240 100644 --- a/playbooks/risk_notable_import_data.yml +++ b/playbooks/risk_notable_import_data.yml @@ -34,6 +34,7 @@ tags: - note_content platform_tags: - Risk Notable + playbook_type: Automation playbook_fields: - event_id - info_min_time diff --git a/playbooks/risk_notable_investigate.yml b/playbooks/risk_notable_investigate.yml index fcdd1261da..cc65a769a2 100644 --- a/playbooks/risk_notable_investigate.yml +++ b/playbooks/risk_notable_investigate.yml @@ -14,6 +14,7 @@ app_list: tags: labels: - risk_notable + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_merge_events.yml b/playbooks/risk_notable_merge_events.yml index bc01af1ae6..1122af6afb 100644 --- a/playbooks/risk_notable_merge_events.yml +++ b/playbooks/risk_notable_merge_events.yml @@ -17,6 +17,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_mitigate.yml b/playbooks/risk_notable_mitigate.yml index 8da0b25461..fd40aaa74f 100644 --- a/playbooks/risk_notable_mitigate.yml +++ b/playbooks/risk_notable_mitigate.yml @@ -13,6 +13,7 @@ app_list: tags: labels: - risk_notable + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_preprocess.yml b/playbooks/risk_notable_preprocess.yml index c90c69d268..f202663f30 100644 --- a/playbooks/risk_notable_preprocess.yml +++ b/playbooks/risk_notable_preprocess.yml @@ -20,6 +20,7 @@ tags: - risk_notable platform_tags: - Risk Notable + playbook_type: Automation playbook_fields: - event_id - info_min_time diff --git a/playbooks/risk_notable_protect_assets_and_users.yml b/playbooks/risk_notable_protect_assets_and_users.yml index 5e0814f400..3bd2ecdb38 100644 --- a/playbooks/risk_notable_protect_assets_and_users.yml +++ b/playbooks/risk_notable_protect_assets_and_users.yml @@ -16,6 +16,7 @@ tags: playbook_outputs: - note_title - note_content + playbook_type: Automation platform_tags: - Risk Notable product: diff --git a/playbooks/risk_notable_review_indicators.yml b/playbooks/risk_notable_review_indicators.yml index ed24f18b4b..129d8413d7 100644 --- a/playbooks/risk_notable_review_indicators.yml +++ b/playbooks/risk_notable_review_indicators.yml @@ -15,5 +15,6 @@ tags: - risk_notable platform_tags: - Risk Notable + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/risk_notable_verdict.yml b/playbooks/risk_notable_verdict.yml index 6470de0a70..2d90aa3a8d 100644 --- a/playbooks/risk_notable_verdict.yml +++ b/playbooks/risk_notable_verdict.yml @@ -15,5 +15,6 @@ tags: - risk_notable platform_tags: - Risk Notable + playbook_type: Automation product: - Splunk SOAR diff --git a/playbooks/start_investigation.yml b/playbooks/start_investigation.yml index d6f4890ba2..6d497d8625 100644 --- a/playbooks/start_investigation.yml +++ b/playbooks/start_investigation.yml @@ -12,5 +12,6 @@ app_list: [] tags: platform_tags: [] playbook_fields: [] + playbook_type: Automation product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/threat_intel_investigate.yml b/playbooks/threat_intel_investigate.yml index 65a3095b34..918f813e98 100644 --- a/playbooks/threat_intel_investigate.yml +++ b/playbooks/threat_intel_investigate.yml @@ -13,6 +13,7 @@ app_list: [] tags: platform_tags: - threat_intel + playbook_type: Automation playbook_fields: [] product: - Splunk SOAR \ No newline at end of file diff --git a/playbooks/trustar_enrich_indicators.yml b/playbooks/trustar_enrich_indicators.yml index 62e2d30c7e..5cd35f9aa0 100644 --- a/playbooks/trustar_enrich_indicators.yml +++ b/playbooks/trustar_enrich_indicators.yml @@ -15,6 +15,7 @@ tags: platform_tags: - threat_intel - risk_notable + playbook_type: Input playbook_fields: - indicators product: diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml new file mode 100644 index 0000000000..fe3ad3cd62 --- /dev/null +++ b/stories/active_directory_kerberos_attacks.yml @@ -0,0 +1,34 @@ +name: Active Directory Kerberos Attacks +id: 38b8cf16-8461-11ec-ade1-acde48001122 +version: 1 +date: '2022-02-02' +author: Mauricio Velazco, Splunk +description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments. +narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and + users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access + to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since + the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases + of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\ + This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in + Kerberos based attacks. +references: +- https://en.wikipedia.org/wiki/Kerberos_(protocol) +- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9 +- https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html +- https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ +- https://attack.mitre.org/techniques/T1558/003/ +- https://attack.mitre.org/techniques/T1550/003/ +- https://attack.mitre.org/techniques/T1558/004/ +tags: + analytic_story: + - Active Directory Kerberos Attacks + category: + - Adversary Tactics + - Account Compromise + - Lateral Movement + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml new file mode 100644 index 0000000000..f6214e87de --- /dev/null +++ b/stories/linux_post_exploitation.yml @@ -0,0 +1,19 @@ +name: Linux Post-Exploitation +id: d310ccfe-5477-11ec-ad05-acde48001122 +version: 1 +date: '2021-12-03' +author: Rod Soto +description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin. +narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version. +references: +- https://attack.mitre.org/matrices/enterprise/linux/ +tags: + analytic_story: + - Linux Post-Exploitation + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml new file mode 100644 index 0000000000..034af504ea --- /dev/null +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml @@ -0,0 +1,15 @@ +name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser Unit Test +tests: +- name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser + file: endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog + + + diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml new file mode 100644 index 0000000000..95445f94db --- /dev/null +++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml @@ -0,0 +1,12 @@ +name: Disabled Kerberos Pre-Authentication Discovery With PowerView Unit Test +tests: +- name: Disabled Kerberos Pre-Authentication Discovery With PowerView + file: endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml index 5ae101f436..0e95642c09 100644 --- a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml +++ b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog update_timestamp: True diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml new file mode 100644 index 0000000000..df1569133d --- /dev/null +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml @@ -0,0 +1,13 @@ +name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl Unit Test +tests: +- name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl + file: endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml new file mode 100644 index 0000000000..2abcf3d741 --- /dev/null +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml @@ -0,0 +1,13 @@ +name: Kerberos Pre-Authentication Flag Disabled with PowerShell Unit Test +tests: +- name: Kerberos Pre-Authentication Flag Disabled with PowerShell + file: endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml b/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml new file mode 100644 index 0000000000..048ca7bf0c --- /dev/null +++ b/tests/endpoint/mimikatz_passtheticket_commandline_parameters.test.yml @@ -0,0 +1,12 @@ +name: Mimikatz PassTheTicket CommandLine Parameters Unit Test +tests: +- name: Mimikatz PassTheTicket CommandLine Parameters + file: endpoint/mimikatz_passtheticket_commandline_parameters.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rubeus_command_line_parameters.test.yml b/tests/endpoint/rubeus_command_line_parameters.test.yml new file mode 100644 index 0000000000..8453ca23c7 --- /dev/null +++ b/tests/endpoint/rubeus_command_line_parameters.test.yml @@ -0,0 +1,12 @@ +name: Rubeus Command Line Parameters Unit Test +tests: +- name: Rubeus Command Line Parameters + file: endpoint/rubeus_command_line_parameters.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml b/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml new file mode 100644 index 0000000000..d20b693254 --- /dev/null +++ b/tests/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml @@ -0,0 +1,12 @@ +name: Rubeus Kerberos Ticket Exports Through Winlogon Access Unit Test +tests: +- name: Rubeus Kerberos Ticket Exports Through Winlogon Access + file: endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml b/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml new file mode 100644 index 0000000000..4ecb8affd8 --- /dev/null +++ b/tests/endpoint/ssa___windows_eventvwr_uac_bypass.test.yml @@ -0,0 +1,10 @@ +name: Windows Eventvwr UAC Bypass Unit Test +tests: +- name: Windows Eventvwr UAC Bypass + file: endpoint/ssa___windows_eventvwr_uac_bypass.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-sysmon-registry.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/ssa_eventvwr/windows-sysmon-registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_linux_discovery_commands.test.yml b/tests/endpoint/suspicious_linux_discovery_commands.test.yml new file mode 100644 index 0000000000..967f560bc8 --- /dev/null +++ b/tests/endpoint/suspicious_linux_discovery_commands.test.yml @@ -0,0 +1,12 @@ +name: Suspicious Linux Discovery Commands +tests: +- name: Suspicious Linux Discovery Commands + file: endpoint/suspicious_linux_discovery_commands.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-60d' + latest_time: 'now' + attack_data: + - file_name: sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon_linux diff --git a/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml b/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml new file mode 100644 index 0000000000..b942d279d0 --- /dev/null +++ b/tests/endpoint/unusual_number_of_kerberos_service_tickets_requested.test.yml @@ -0,0 +1,12 @@ +name: Unusual Number of Kerberos Service Tickets Requested Unit Test +tests: +- name: Unusual Number of Kerberos Service Tickets Requested + file: endpoint/unusual_number_of_kerberos_service_tickets_requested.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog \ No newline at end of file