From 8a1bed2fb9c8150baad8163fa8cc3aa3c463b44b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 11 Oct 2021 11:03:20 +0200 Subject: [PATCH 1/7] CARS_UPDATE_MITRE_ID_B1 --- .../abnormally_high_number_of_cloud_infrastructure_api_calls.yml | 1 + .../abnormally_high_number_of_cloud_security_group_api_calls.yml | 1 + .../cloud/aws_create_policy_version_to_allow_all_resources.yml | 1 + detections/cloud/aws_createaccesskey.yml | 1 + detections/cloud/aws_createloginprofile.yml | 1 + detections/cloud/aws_ecr_container_scanning_findings_high.yml | 1 + ...ecr_container_scanning_findings_low_informational_unknown.yml | 1 + detections/cloud/aws_ecr_container_scanning_findings_medium.yml | 1 + .../cloud/aws_ecr_container_upload_outside_business_hours.yml | 1 + detections/cloud/aws_ecr_container_upload_unknown_user.yml | 1 + detections/cloud/aws_iam_successful_group_deletion.yml | 1 + ...s_network_access_control_list_created_with_all_open_ports.yml | 1 + detections/cloud/aws_network_access_control_list_deleted.yml | 1 + detections/cloud/aws_setdefaultpolicyversion.yml | 1 + detections/cloud/aws_updateloginprofile.yml | 1 + .../cloud_compute_instance_created_by_previously_unseen_user.yml | 1 + .../cloud_instance_modified_with_previously_unseen_user.yml | 1 + detections/cloud/correlation_by_repository_and_risk.yml | 1 + detections/cloud/correlation_by_user_and_risk.yml | 1 + detections/cloud/github_dependabot_alert.yml | 1 + detections/cloud/github_pull_request_from_unknown_user.yml | 1 + detections/cloud/gsuite_drive_share_in_external_email.yml | 1 + detections/cloud/gsuite_email_suspicious_attachment.yml | 1 + .../cloud/gsuite_email_suspicious_subject_with_attachment.yml | 1 + .../cloud/gsuite_email_with_known_abuse_web_service_link.yml | 1 + .../gsuite_outbound_email_with_attachment_to_external_domain.yml | 1 + detections/cloud/gsuite_suspicious_shared_file_name.yml | 1 + detections/cloud/o365_add_app_role_assignment_grant_user.yml | 1 + detections/cloud/o365_added_service_principal.yml | 1 + detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 1 + detections/cloud/o365_new_federated_domain_added.yml | 1 + detections/cloud/o365_suspicious_admin_email_forwarding.yml | 1 + detections/cloud/o365_suspicious_rights_delegation.yml | 1 + detections/cloud/o365_suspicious_user_email_forwarding.yml | 1 + 34 files changed, 34 insertions(+) diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 0d15635152..71e463fbf9 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -44,6 +44,7 @@ tags: of $expected_upper_threshold$ with the following command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 2b216b747e..1228ec4926 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -49,6 +49,7 @@ tags: command $command$. mitre_attack_id: - T1078.004 + - T1078 nist: - DE.DP - DE.CM diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index eeda62b531..931bf81982 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -46,6 +46,7 @@ tags: in their account mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index ed140d24b7..5c2276390f 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -43,6 +43,7 @@ tags: from this IP $src$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index b537158602..5a203a77d8 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -46,6 +46,7 @@ tags: and did a console login from this IP $src_ip$ mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index e7eca8106c..9a9eeb3114 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -37,6 +37,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index f6c36e1a8a..2baabc0834 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -36,6 +36,7 @@ tags: message: Vulnerabilities with severity high found in repository $repositoryName$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index eda8bdae60..755368af77 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -35,6 +35,7 @@ tags: message: Vulnerabilities with severity high found in image $image$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 2d193b4d16..e64f1de95b 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded outside business hours from $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index 0e15c5211e..82d4fd850e 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Container uploaded from unknown user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 6efc567d1d..c39a47fc4d 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -42,6 +42,7 @@ tags: mitre_attack_id: - T1069.003 - T1098 + - T1069 observable: - name: src type: IP Address diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index a7059316a2..028c55621a 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -46,6 +46,7 @@ tags: CIDR $requestParameters.cidrBlock$ mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 55634ba086..5a09c419bf 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -41,6 +41,7 @@ tags: $eventName$), such that the instance is accessible from anywhere mitre_attack_id: - T1562.007 + - T1562 nist: - DE.DP - DE.AE diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 546333f7e9..6f90e57391 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -45,6 +45,7 @@ tags: event $eventName$ for updating the the default policy version mitre_attack_id: - T1078.004 + - T1078 nist: - PR.DS - PR.AC diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 2d6d80437e..0c7fd9c7b2 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -39,6 +39,7 @@ tags: user $user_arn$ more access privilleges mitre_attack_id: - T1136.003 + - T1136 nist: - PR.DS - PR.AC diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index f70c6e911a..43c8ea2de0 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is creating a new instance $dest$ for the first time mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 185d54b516..f05c111905 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -44,6 +44,7 @@ tags: message: User $user$ is modifying an instance $dest$ for the first time. mitre_attack_id: - T1078.004 + - T1078 nist: - ID.AM observable: diff --git a/detections/cloud/correlation_by_repository_and_risk.yml b/detections/cloud/correlation_by_repository_and_risk.yml index 78763720ca..8cae1eaf2f 100644 --- a/detections/cloud/correlation_by_repository_and_risk.yml +++ b/detections/cloud/correlation_by_repository_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/correlation_by_user_and_risk.yml b/detections/cloud/correlation_by_user_and_risk.yml index 6cbb1f0832..220dcb76c1 100644 --- a/detections/cloud/correlation_by_user_and_risk.yml +++ b/detections/cloud/correlation_by_user_and_risk.yml @@ -27,6 +27,7 @@ tags: message: Correlation triggered for user $user$ mitre_attack_id: - T1204.003 + - T1204 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 4294037188..0ac8b391b0 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 3f4235831b..82025ef1a6 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -33,6 +33,7 @@ tags: message: Vulnerabilities found in packages used by GitHub repository $repository$ mitre_attack_id: - T1195.001 + - T1195 nist: - PR.DS - PR.AC diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index b451a2c38f..7ce9b0e3bd 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -41,6 +41,7 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1567.002 + - T1567 observable: - name: parameters.owner type: User diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 664b291d70..5bf5875a1f 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -41,6 +41,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index be34394965..43da966e82 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -49,6 +49,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index aaf6b6cf5f..9ed9c63dd0 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1566.001 + - T1566 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index d4e3964783..c3792b9f3f 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -40,6 +40,7 @@ tags: message: suspicious email from $source.address$ to $destination{}.address$ mitre_attack_id: - T1048.003 + - T1048 observable: - name: source.address type: User diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 65c240346c..13bb20d2aa 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -46,6 +46,7 @@ tags: message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ mitre_attack_id: - T1566.001 + - T1566 observable: - name: parameters.owner type: User diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 577c75383a..731f801395 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -41,6 +41,7 @@ tags: Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index ea17167487..6bcfb6259b 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -44,6 +44,7 @@ tags: service principal credentials from IP Address $ActorIpAddress$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: ActorIpAddress type: IP Address diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index 1fc40093a1..4a9a8ef9ea 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -45,6 +45,7 @@ tags: list of trusted IPs to bypass MFA mitre_attack_id: - T1562.007 + - T1562 observable: - name: ip_addresses_new_added type: IP Address diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 5984dfc60d..7a416e6f60 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -44,6 +44,7 @@ tags: $OrganizationName$ mitre_attack_id: - T1136.003 + - T1136 observable: - name: OrganizationName type: Other diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 82746f0989..cbb85e57e6 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -39,6 +39,7 @@ tags: the same destination $ForwardingAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 06d05f296e..be8f002199 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -38,6 +38,7 @@ tags: that allow access to sensitive mitre_attack_id: - T1114.002 + - T1114 nist: - DE.DP - DE.AE diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 9a7276d8b6..7644ef34f2 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -39,6 +39,7 @@ tags: a forwarding rule to same destination $ForwardingSmtpAddress$ mitre_attack_id: - T1114.003 + - T1114 nist: - DE.DP - DE.AE From cd46d4cf61a0c201112a70271f601b0baefae1bd Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 11 Oct 2021 11:05:34 +0200 Subject: [PATCH 2/7] Delete screensaver_event_trigger_execution.yml --- .../screensaver_event_trigger_execution.yml | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 detections/endpoint/screensaver_event_trigger_execution.yml diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml deleted file mode 100644 index dd457c5f95..0000000000 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Screensaver Event Trigger Execution -id: 58cea3ec-1f6d-11ec-8560-acde48001122 -version: 1 -date: '2021-09-27' -author: Teoderick Contreras, Splunk -type: TTP -datamodel: -- Endpoint -description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification. - This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution - to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*") - by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `screensaver_event_trigger_execution_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data - that records registry activity from your hosts to populate the endpoint data model - in the registry node. This is typically populated via endpoint detection-and-response - product, such as Carbon Black or endpoint data sources, such as Sysmon. The data - used for this search is typically generated via logs that report reads and writes - to the registry. -known_false_positives: unknown -references: -- https://attack.mitre.org/techniques/T1546/002/ -- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver -tags: - analytic_story: - - Windows Persistence Techniques - - Windows Privilege Escalation - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1546.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - security_domain: endpoint - impact: 80 - confidence: 90 - # (impact * confidence)/100 - risk_score: 72 - context: - - source:endpoint - - stage:Privilege Escalation Persistence - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: user - role: - - Victim - \ No newline at end of file From e564e5a9f2651115f355be698f764f0bac8892e6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 11 Oct 2021 11:05:42 +0200 Subject: [PATCH 3/7] Delete screensaver_event_trigger_execution.test.yml --- .../screensaver_event_trigger_execution.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/screensaver_event_trigger_execution.test.yml diff --git a/tests/endpoint/screensaver_event_trigger_execution.test.yml b/tests/endpoint/screensaver_event_trigger_execution.test.yml deleted file mode 100644 index 4e398660f6..0000000000 --- a/tests/endpoint/screensaver_event_trigger_execution.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Screensaver Event Trigger Execution Unit Test -tests: -- name: Screensaver Event Trigger Execution - file: endpoint/screensaver_event_trigger_execution.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file From d2719d316e4327d3b36da1befe53338056044e30 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 12 Oct 2021 11:12:12 +0200 Subject: [PATCH 4/7] Update gsuite_drive_share_in_external_email.yml --- detections/cloud/gsuite_drive_share_in_external_email.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 7ce9b0e3bd..552014e94a 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -67,3 +67,4 @@ tags: - parameters.doc_type risk_score: 72 security_domain: endpoint + From 7dbacd0674077ab57a6ae6f317dd0dbc580f5093 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Oct 2021 13:02:16 -0700 Subject: [PATCH 5/7] errors and text updates --- detections/cloud/github_commit_changes_in_master.yml | 2 +- detections/cloud/github_commit_in_develop.yml | 2 +- detections/cloud/gsuite_drive_share_in_external_email.yml | 8 +++----- detections/cloud/gsuite_email_suspicious_attachment.yml | 2 +- .../gsuite_email_suspicious_subject_with_attachment.yml | 2 +- .../gsuite_email_with_known_abuse_web_service_link.yml | 2 +- ..._outbound_email_with_attachment_to_external_domain.yml | 2 +- detections/cloud/gsuite_suspicious_shared_file_name.yml | 4 ++-- 8 files changed, 11 insertions(+), 13 deletions(-) diff --git a/detections/cloud/github_commit_changes_in_master.yml b/detections/cloud/github_commit_changes_in_master.yml index 8b6d910d1e..9475fcad55 100644 --- a/detections/cloud/github_commit_changes_in_master.yml +++ b/detections/cloud/github_commit_changes_in_master.yml @@ -23,7 +23,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/github_commit_in_develop.yml b/detections/cloud/github_commit_in_develop.yml index 85c5cf21f8..e069f8de60 100644 --- a/detections/cloud/github_commit_in_develop.yml +++ b/detections/cloud/github_commit_in_develop.yml @@ -22,7 +22,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 30 context: diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index b451a2c38f..28b9e83f44 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -19,22 +19,20 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner | `gsuite_drive_share_in_external_email_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: network admin or normal user may share files to customer and external team. references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 90 context: - Source:Endpoint - Stage:Reconnaissance dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log - deployments: - - Send to Phantom impact: 80 kill_chain_phases: - Exfiltration @@ -45,7 +43,7 @@ tags: - name: parameters.owner type: User role: - - attacker + - Attacker - name: email type: User role: diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 664b291d70..b2a236dbda 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -28,7 +28,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 70 context: - Source:Endpoint diff --git a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml index be34394965..b7177c13e3 100644 --- a/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml @@ -35,7 +35,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: diff --git a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml index aaf6b6cf5f..7db1ebb558 100644 --- a/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml +++ b/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml @@ -26,7 +26,7 @@ references: - https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/ tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 50 context: diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index d4e3964783..f7b8d47b1f 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -27,7 +27,7 @@ references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: analytic_story: - - DevSecOps + - Dev Sec Ops confidence: 30 context: - Source:Endpoint diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 65c240346c..e50926bc6a 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -24,7 +24,7 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit | `gsuite_suspicious_shared_file_name_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file - extension, source email, destination email, num of attachment and etc. + extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`. known_false_positives: normal user or normal transaction may contain the subject and file type attachment that this detection try to search references: @@ -32,7 +32,7 @@ references: - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf tags: analytic_story: - - DevSecOps + - Dev Sec Ops automated_detection_testing: passed confidence: 70 context: From 05972240f4ee88e20826c3c455392a9bf97d915b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 12 Oct 2021 13:03:43 -0700 Subject: [PATCH 6/7] story name --- stories/dev_sec_ops.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/dev_sec_ops.yml b/stories/dev_sec_ops.yml index e800aef9d9..b7008f38b2 100644 --- a/stories/dev_sec_ops.yml +++ b/stories/dev_sec_ops.yml @@ -14,7 +14,7 @@ narrative: DevSecOps is a collaborative framework, which thinks about applicatio references: - https://www.redhat.com/en/topics/devops/what-is-devsecops tags: - analytic_story: DevSecOps + analytic_story: Dev Sec Ops category: - Cloud Security product: From f67ee09979f0162b971785218100db98aa8630c3 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 12 Oct 2021 13:08:33 -0700 Subject: [PATCH 7/7] revert deployments: - Send to Phantom --- detections/cloud/gsuite_drive_share_in_external_email.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 28b9e83f44..8d8d37bef2 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -33,6 +33,8 @@ tags: - Stage:Reconnaissance dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567.002/gsuite_share_drive/gdrive_share_external.log + deployments: + - Send to Phantom impact: 80 kill_chain_phases: - Exfiltration