From d7000e760877f4f13395d456ab9878e975bcdceb Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 28 Jul 2021 10:39:38 -0400 Subject: [PATCH 1/3] added event_id to ssa detections --- .../endpoint/powershell_encoded_command.yml | 41 +++++++++++++++++++ ...tolen_credentials_via_mimikatz_modules.yml | 2 +- ...en_credentials_via_powersploit_modules.yml | 2 +- ...ntial_strength_via_dsinternals_modules.yml | 2 +- .../ssa___attempt_to_delete_services.yml | 2 +- .../ssa___attempt_to_disable_services.yml | 2 +- ...dential_dump_from_registry_via_reg_exe.yml | 2 +- ...raction_dsinternals_conversion_modules.yml | 2 +- ...dential_extraction_dsinternals_modules.yml | 2 +- ...l_extraction_fgdump_cachedump_s_option.yml | 2 +- ...l_extraction_fgdump_cachedump_v_option.yml | 2 +- ...al_extraction_getaddbaccount_from_dump.yml | 2 +- ...ial_extraction_lazagne_command_options.yml | 2 +- ...credential_extraction_mimikatz_modules.yml | 2 +- ...al_extraction_ms_debuggers_kernel_peek.yml | 2 +- ...ntial_extraction_ms_debuggers_z_option.yml | 2 +- ...dential_extraction_powersploit_modules.yml | 2 +- .../endpoint/ssa___delete_a_net_user.yml | 2 +- ...___deny_permission_using_cacls_utility.yml | 2 +- ...detect_dump_lsass_memory_using_comsvcs.yml | 2 +- .../endpoint/ssa___detect_kerberoasting.yml | 2 +- .../endpoint/ssa___detect_pass_hash.yml | 2 +- .../ssa___disable_net_user_account.yml | 2 +- .../ssa___first_time_seen_cmd_line.yml | 2 +- ...__grant_permission_using_cacls_utility.yml | 2 +- ...s_user_content_via_powersploit_modules.yml | 2 +- ...count_creation_via_powersploit_modules.yml | 2 +- ...enable_disable_via_dsinternals_modules.yml | 2 +- ...egal_log_deletion_via_mimikatz_modules.yml | 2 +- ...s_and_policies_via_dsinternals_modules.yml | 2 +- ...nd_AD_elements_via_powersploit_modules.yml | 2 +- ...nd_persistence_via_powersploit_modules.yml | 2 +- ...ivilege_elevation_via_mimikatz_modules.yml | 2 +- ...d_process_control_via_mimikatz_modules.yml | 2 +- ...rocess_control_via_powersploit_modules.yml | 2 +- ...fy_acls_permission_of_files_or_folders.yml | 2 +- ...en_credentials_via_powersploit_modules.yml | 2 +- ...a___prohibited_apps_spawning_cmdprompt.yml | 2 +- ..._opportunities_via_powersploit_modules.yml | 2 +- ...roups_policies_via_powersploit_modules.yml | 2 +- ...e_accounts_groups_via_mimikatz_modules.yml | 2 +- ...infrastructure_via_powersploit_modules.yml | 2 +- ...puters_domains_via_powersploit_modules.yml | 2 +- ...and_use_computers_via_mimikatz_modules.yml | 2 +- ...ystem_elements_via_powersploit_modules.yml | 2 +- ...on_and_use_shares_via_mimikatz_modules.yml | 2 +- ...and_use_shares_via_powersploit_modules.yml | 2 +- ...n_connectivity_via_powersploit_modules.yml | 2 +- ...ores_and_services_via_mimikatz_modules.yml | 2 +- ...efensive_tools_via_powersploit_modules.yml | 2 +- ..._opportunities_via_powersploit_modules.yml | 2 +- ...service_hijacking_via_mimikatz_modules.yml | 2 +- ...sses_and_services_via_mimikatz_modules.yml | 2 +- .../ssa___resize_shadowstorage_volume.yml | 2 +- ...ng_credentials_via_dsinternals_modules.yml | 2 +- ...tting_credentials_via_mimikatz_modules.yml | 2 +- ...ng_credentials_via_powersploit_modules.yml | 2 +- ...em_process_running_unexpected_location.yml | 2 +- ...unusual_lolbas_in_short_period_of_time.yml | 2 +- .../ssa___unusually_long_command_line.yml | 2 +- .../ssa___wevtutil_usage_to_clear_logs.yml | 2 +- .../ssa___wevtutil_usage_to_disable_logs.yml | 2 +- 62 files changed, 102 insertions(+), 61 deletions(-) create mode 100644 detections/endpoint/powershell_encoded_command.yml diff --git a/detections/endpoint/powershell_encoded_command.yml b/detections/endpoint/powershell_encoded_command.yml new file mode 100644 index 0000000000..90882a8934 --- /dev/null +++ b/detections/endpoint/powershell_encoded_command.yml @@ -0,0 +1,41 @@ +name: Powershell Encoded Command +id: ff61b196-e89e-11eb-926b-550bf0943fbb +version: 1 +date: '2021-07-19' +author: fdgdfs +type: batch +datamodel: +- Endpoint +description: | + UPDATE_DESCRIPTION + WHAT IS THIS? + WHAT DOES IT LOOK LIKE? + HOW DO YOU TRIAGE IT? +search: '| UPDATE_SPLfdgsdfg | `powershell_encoded_command_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: access + impact: + confidence: + # (impact * confidence)/100 + risk_score: + context: + message: + observable: + \ No newline at end of file diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index ecb09f7e98..5433b517d1 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 16e8b0e679..ece5f6a836 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 633ae2f609..2ffa42a38c 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index c6b479fa22..3920b59977 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 05865adfa6..b23179443b 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, - "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", + "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 3d19e423e1..cbfaf5ad96 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, - dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events(); ' how_to_implement: You must be ingesting windows endpoint data that tracks process activity, including parent-child relationships from your endpoints. diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index d8d32dad82..8bed9748f4 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 79db9249a7..a31a85b529 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index d14effa4d7..233748e9ab 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -24,7 +24,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 4b4a04dc24..5fd415c580 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -22,7 +22,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 6fc58c60fa..edf74d20df 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 020080237e..937f27dfbe 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index ebe6f4588f..cb3366b13d 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 95fb6ac305..0c5b151a22 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -23,7 +23,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 1c36de7878..e5c4bc8746 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index 04dbeae255..a1be45dd49 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 18226a3a7c..e8d4d86b3f 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: o successfully implement this search, you need to be ingesting logs diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index 324178117e..f87d0b5d4d 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 46397d9466..2ea50aa260 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), - body=create_map(["process_name", process_name]) | into write_ssa_detected_events();' + body=create_map(["event_id", event_id, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index ac4bca3592..10560f9aad 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -16,7 +16,7 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_ | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID - | eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode, + | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))| diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 3acdee459f..e87634f210 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events() AND authentication_method="seclogo") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method", + dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, "authentication_method", authentication_method]) | into write_ssa_detected_events();' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index d7d1aff9a1..07cbece0c6 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 747832406a..a4b963df15 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map ""), /.* \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm | eval start_time = timestamp, end_time = timestamp, - entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line", + entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be populating the endpoint data model for SSA and specifically the process_name and the process fields diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 291da7b3bd..f36e49dba5 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index d823bc0991..ee72f43413 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 212c382844..7f613f0c3c 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 8117269ce4..5a019f8155 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 9820dcb2a8..5a71a03e53 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 4190380254..a852a980a4 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index f078d62322..49385cf1aa 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index d085cc9296..921a78a896 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index fccfccad9f..d289582667 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 8f5d877367..c915772459 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 8883cfe1e2..1fa388956a 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 43d0dbea67..ca3246e3a3 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 4f796555b4..41a1ecd3fb 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 8fb17415ed..fccc315370 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -24,7 +24,7 @@ search: '| from read_ssa_enriched_events() OR field0="java.exe" OR field0="powershell.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, - dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name", + dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name", parent_process]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon logs. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index b1653762d6..9d518b7c68 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -28,7 +28,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 7f8cf6e654..6a2daa419e 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -37,7 +37,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index be4717def3..4e056fe858 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index a7e80199eb..0d6d712c2b 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 6e3077f5bd..3eb0e191fe 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index f65abc61c0..b0b2f1f551 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 02d762f620..43ef3e1c0e 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index a3f1c2d85b..d7cd2ceff1 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 64a86372ba..b72ab6a615 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 647dcf4512..1575b4cb87 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 5cfdef007f..3221f6c872 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 32ef4abbeb..8473a8e8e3 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index f8f29c6fdf..3404baafdd 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 034d96eae1..b404abb4ca 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 1f7bf96dc5..05d8caa170 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index 15aa136dae..6b355e538a 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 20ee3eb47d..952aea909e 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 7847644266..cd10c7141a 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 7099d84b62..dd0257da00 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events() | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting Windows Security logs from devices of interest, including the event ID 4688 with enabled command line logging. known_false_positives: None identified. diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index a24ce7dc5c..2f6ac824eb 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -226,7 +226,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp, - end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", + end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 5a5eecd537..e6ba711eb6 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -40,7 +40,7 @@ search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_ev device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, - end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", + end_time = timestamp, entities = mvappend(device), body=create_map(["event_id", event_id, "lolbas_counter", lolbas_counter]) | into write_null();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index ec9e82b65f..28e527fedb 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -21,7 +21,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id", "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp, - end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line", + end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting sysmon endpoint data that monitors command lines. diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 848a73c031..ce791cbac0 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map /(?i)powershell/)=true) AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), - body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", + body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index 3de5522398..a7a2b9bda1 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your From b8fea6311e36e3f15c40674e89a422523a3769e8 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 28 Jul 2021 10:42:18 -0400 Subject: [PATCH 2/3] Delete powershell_encoded_command.yml --- .../endpoint/powershell_encoded_command.yml | 41 ------------------- 1 file changed, 41 deletions(-) delete mode 100644 detections/endpoint/powershell_encoded_command.yml diff --git a/detections/endpoint/powershell_encoded_command.yml b/detections/endpoint/powershell_encoded_command.yml deleted file mode 100644 index 90882a8934..0000000000 --- a/detections/endpoint/powershell_encoded_command.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Powershell Encoded Command -id: ff61b196-e89e-11eb-926b-550bf0943fbb -version: 1 -date: '2021-07-19' -author: fdgdfs -type: batch -datamodel: -- Endpoint -description: | - UPDATE_DESCRIPTION - WHAT IS THIS? - WHAT DOES IT LOOK LIKE? - HOW DO YOU TRIAGE IT? -search: '| UPDATE_SPLfdgsdfg | `powershell_encoded_command_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES -references: -tags: - analytic_story: - - UPDATE_STORY_NAME - dataset: - - UPDATE_DATASET_URL - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1003.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - security_domain: access - impact: - confidence: - # (impact * confidence)/100 - risk_score: - context: - message: - observable: - \ No newline at end of file From f8fc79d4e19d88e1297050ba85379e74bddcc165 Mon Sep 17 00:00:00 2001 From: peter-cg <682716+peter-cg@users.noreply.github.com> Date: Tue, 3 Aug 2021 14:45:44 -0500 Subject: [PATCH 3/3] Adding event_id extraction --- ...sa___applying_stolen_credentials_via_mimikatz_modules.yml | 3 ++- ...__applying_stolen_credentials_via_powersploit_modules.yml | 3 ++- ...___assess_credential_strength_via_dsinternals_modules.yml | 3 ++- detections/endpoint/ssa___attempt_to_delete_services.yml | 3 ++- detections/endpoint/ssa___attempt_to_disable_services.yml | 3 ++- ...__attempted_credential_dump_from_registry_via_reg_exe.yml | 3 ++- ..._credential_extraction_dsinternals_conversion_modules.yml | 3 ++- .../ssa___credential_extraction_dsinternals_modules.yml | 3 ++- ...ssa___credential_extraction_fgdump_cachedump_s_option.yml | 3 ++- ...ssa___credential_extraction_fgdump_cachedump_v_option.yml | 3 ++- .../ssa___credential_extraction_getaddbaccount_from_dump.yml | 3 ++- .../ssa___credential_extraction_lazagne_command_options.yml | 3 ++- .../ssa___credential_extraction_mimikatz_modules.yml | 3 ++- .../ssa___credential_extraction_ms_debuggers_kernel_peek.yml | 3 ++- .../ssa___credential_extraction_ms_debuggers_z_option.yml | 3 ++- .../ssa___credential_extraction_powersploit_modules.yml | 3 ++- detections/endpoint/ssa___delete_a_net_user.yml | 3 ++- .../endpoint/ssa___deny_permission_using_cacls_utility.yml | 3 ++- .../ssa___detect_dump_lsass_memory_using_comsvcs.yml | 5 +++-- detections/endpoint/ssa___detect_kerberoasting.yml | 3 ++- detections/endpoint/ssa___detect_pass_hash.yml | 2 +- detections/endpoint/ssa___disable_net_user_account.yml | 3 ++- detections/endpoint/ssa___first_time_seen_cmd_line.yml | 3 ++- .../endpoint/ssa___grant_permission_using_cacls_utility.yml | 3 ++- ...__illegal_access_user_content_via_powersploit_modules.yml | 3 ++- ...sa___illegal_account_creation_via_powersploit_modules.yml | 3 ++- ...llegal_account_enable_disable_via_dsinternals_modules.yml | 3 ++- .../ssa___illegal_log_deletion_via_mimikatz_modules.yml | 3 ++- ...ment_AD_elements_and_policies_via_dsinternals_modules.yml | 3 ++- ...ent_computers_and_AD_elements_via_powersploit_modules.yml | 3 ++- ...ege_elevation_and_persistence_via_powersploit_modules.yml | 3 ++- ...sa___illegal_privilege_elevation_via_mimikatz_modules.yml | 3 ++- ...egal_service_and_process_control_via_mimikatz_modules.yml | 3 ++- ...l_service_and_process_control_via_powersploit_modules.yml | 3 ++- .../ssa___modify_acls_permission_of_files_or_folders.yml | 3 ++- ...ccess_with_stolen_credentials_via_powersploit_modules.yml | 3 ++- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 3 ++- .../ssa___rare_parent_process_relationship_lolbas.yml | 3 ++- ...and_persistence_opportunities_via_powersploit_modules.yml | 3 ++- ..._use_accounts_groups_policies_via_powersploit_modules.yml | 3 ++- ...___recon_and_use_accounts_groups_via_mimikatz_modules.yml | 3 ++- ...tive_directory_infrastructure_via_powersploit_modules.yml | 3 ++- ...con_and_use_computers_domains_via_powersploit_modules.yml | 3 ++- .../ssa___recon_and_use_computers_via_mimikatz_modules.yml | 3 ++- ...use_operating_system_elements_via_powersploit_modules.yml | 3 ++- .../ssa___recon_and_use_shares_via_mimikatz_modules.yml | 3 ++- .../ssa___recon_and_use_shares_via_powersploit_modules.yml | 3 ++- .../ssa___recon_connectivity_via_powersploit_modules.yml | 3 ++- ...n_credential_stores_and_services_via_mimikatz_modules.yml | 3 ++- .../ssa___recon_defensive_tools_via_powersploit_modules.yml | 3 ++- ...lege_escalation_opportunities_via_powersploit_modules.yml | 3 ++- ..._recon_process_service_hijacking_via_mimikatz_modules.yml | 3 ++- ...a___recon_processes_and_services_via_mimikatz_modules.yml | 3 ++- detections/endpoint/ssa___resize_shadowstorage_volume.yml | 3 ++- .../ssa___setting_credentials_via_dsinternals_modules.yml | 3 ++- .../ssa___setting_credentials_via_mimikatz_modules.yml | 3 ++- .../ssa___setting_credentials_via_powersploit_modules.yml | 3 ++- .../ssa___system_process_running_unexpected_location.yml | 2 +- .../ssa___unusual_lolbas_in_short_period_of_time.yml | 2 +- detections/endpoint/ssa___unusually_long_command_line.yml | 3 ++- detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml | 3 ++- detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 3 ++- 62 files changed, 122 insertions(+), 63 deletions(-) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index 5433b517d1..5d5efcd2f7 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -9,7 +9,8 @@ description: This detection indicates use of Mimikatz modules that facilitate Pa attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", - null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index ece5f6a836..bbd8fec3c4 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -12,7 +12,8 @@ description: Stolen credentials are applied by methods such as user impersonatio search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 2ffa42a38c..4bd7dae1cc 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of DSInternals modules that verify pa search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index 3920b59977..2731d5bb83 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index b23179443b..6733b9599a 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -16,7 +16,8 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index cbfaf5ad96..c248d53128 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -11,7 +11,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" OR process_name="reg.exe" | where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index 8bed9748f4..71463e23fb 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -16,7 +16,8 @@ search: '| from read_ssa_enriched_events() process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index a31a85b529..80e336023d 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 233748e9ab..c7f1cc3c54 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -17,7 +17,8 @@ search: ' | from read_ssa_enriched_events() cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND process_name != null AND parent_process_name + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND parent_process_name != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 5fd415c580..8a9d12996b 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -16,7 +16,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), - "string", null) | where cmd_line != null AND process_name != null AND process_path + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index edf74d20df..36cdd32b5b 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -14,7 +14,8 @@ description: Credential extraction is often an illegal recovery of credential ma search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 937f27dfbe..c6642280ca 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -13,7 +13,8 @@ description: Credential extraction is often an illegal recovery of credential ma search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index cb3366b13d..31e3d2b244 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 0c5b151a22..35ec20bf69 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -15,7 +15,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line != null AND parent_process_name + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND parent_process_name != null AND process_name != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index e5c4bc8746..1bb21416ba 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -14,7 +14,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, - "process_name"), "string", null) | where cmd_line != null AND process_name != null + "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND process_name != null AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index a1be45dd49..a4f2a1fa10 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index e8d4d86b3f..2dde626af4 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -17,7 +17,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index f87d0b5d4d..8dc9164db4 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -14,7 +14,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 2ea50aa260..42a14efbf0 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -11,8 +11,9 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", - null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) | - where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true + null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), + event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id, "process_name", process_name]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting endpoint data that tracks process activity, diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 10560f9aad..b5edb0aaf7 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -12,7 +12,8 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_ "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", - null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index e87634f210..34909eee66 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -14,7 +14,7 @@ search: ' | from read_ssa_enriched_events() "authentication_type"), authentication_method=map_get(input_event, "authentication_method"), origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null) + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9" AND authentication_method="seclogo") diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index 07cbece0c6..00c4a1fdb0 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index a4b963df15..af2b9c4c8d 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -18,7 +18,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"), /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, - /\d+/, "N") | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", + /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id, dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm | eval start_time = timestamp, end_time = timestamp, diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index f36e49dba5..62f8f53196 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -14,7 +14,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index ee72f43413..aa36f3b5b2 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 7f613f0c3c..bf83556b14 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that create search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 5a019f8155..8c8e4a5a75 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of DSInternals modules that enable or search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true ) diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 5a71a03e53..1b63b5a8f2 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that delete search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true ) diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index a852a980a4..5fbebe9f19 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies use of DSInternals modules for illegal ma search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true ) diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index 49385cf1aa..1c6bcef846 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true ) diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 921a78a896..efc7522548 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that illega search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index d289582667..3c2a8ccb59 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for illegal privi search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true ) diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index c915772459..debc75fd6e 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for illegal contr search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 1fa388956a..3a6a2be8b7 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules that enable search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index ca3246e3a3..12ba448867 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -16,7 +16,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 41a1ecd3fb..eac07c811f 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of PowerSploit modules that facilitat search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true ) diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index fccc315370..e79b2cb80c 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), - dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) + dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe" | rex field=parent_process "(?[^\\\\]+)$" | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index f946e48aae..8c99cb828c 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), - "string", null) | where parent_process_name!=null | select parent_process_name, + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where parent_process_name!=null | select parent_process_name, process_name, cmd_line, timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name" target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe" diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index 9d518b7c68..68a1d9ccc2 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -13,7 +13,8 @@ description: This detection identifies use of PowerSploit modules that discover search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 6a2daa419e..b6787b7172 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 4e056fe858..f647db5dee 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for discovery of search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true ) diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index 0d6d712c2b..779d3a8915 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules for reconna search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 3eb0e191fe..e899edf6ca 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index b0b2f1f551..44173c043c 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for discovery of search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 43ef3e1c0e..f3ce7d571f 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index d7cd2ceff1..c3b890b3b5 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for discovery and search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index b72ab6a615..cd02448f35 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 1575b4cb87..cdab390ef6 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules for reconna search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 3221f6c872..3fc583f000 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies reconnaissance of credential stores and u search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 8473a8e8e3..32d70c14e9 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of PowerSploit modules for assessment search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index 3404baafdd..4d488adaa2 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of PowerSploit modules for assessment search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index b404abb4ca..4763f416a3 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -14,7 +14,8 @@ description: This detection identifies use of Mimikatz modules for discovery of search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 05d8caa170..7e1999d04b 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for discovery and search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true ) diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index 6b355e538a..74b24ad268 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -17,7 +17,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null) | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 952aea909e..976cba71c9 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -13,7 +13,8 @@ search: '| from read_ssa_enriched_events() process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), - "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true + "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index cd10c7141a..448b877477 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies illegal setting of credentials via Mimika search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true ) diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index dd0257da00..d8cc6c0f62 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -10,7 +10,8 @@ description: This detection identifies illegal setting of credentials via PowerS search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), - cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line + cmd_line=ucast(map_get(input_event, "process"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index 2f6ac824eb..cdc56115b7 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -16,7 +16,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", - null)); + null)), event_id=ucast(map_get(input_event, "event_id"), "string", null); $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index e6ba711eb6..5a5eecd537 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -40,7 +40,7 @@ search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_ev device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start, - end_time = timestamp, entities = mvappend(device), body=create_map(["event_id", event_id, "lolbas_counter", + end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", lolbas_counter]) | into write_null();' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 28e527fedb..8f0861acd9 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -13,7 +13,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), - process_name=ucast(map_get(input_event, "process_name"), "string", null) | where + process_name=ucast(map_get(input_event, "process_name"), "string", null), + event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index ce791cbac0..68350a2464 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -13,7 +13,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line, diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index a7a2b9bda1..d286d41a21 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -13,7 +13,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, - "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, + "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) + | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),