admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

minor fixes to queries

Browse Source
This commit is contained in:
mvelazco
2021-05-06 15:00:16 -04:00
parent 946ce19415
commit 076d9dbc11
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
+1 -1
View File
@@ -25,7 +25,7 @@ search: ' `wineventlog_security` EventCode=4648
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1
`multiple_users_attempting_to_authenticate_using_explicit_credentials_filter`'
| `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as
well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled.
known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems.
detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
+2 -2
View File
@@ -23,8 +23,8 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Addr
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 
| `multiple_users_remotely_failing_to_authenticate_from_host_filter`'
| search isOutlier=1
| `multiple_users_remotely_failing_to_authenticate_from_host_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as
as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled.
known_false_positives: A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems.
tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml
+1 -1
View File
@@ -7,6 +7,6 @@ tests:
latest_time: 'now'
attack_data:
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
source: WinEventLog:Security
sourcetype: WinEventLog