From 076d9dbc1157fc0cb9bcfebfc8eb582bc3b64545 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 6 May 2021 15:00:16 -0400 Subject: [PATCH] minor fixes to queries --- ..._attempting_to_authenticate_using_explicit_credentials.yml | 2 +- ...tiple_users_remotely_failing_to_authenticate_from_host.yml | 4 ++-- ...sers_failing_to_authenticate_from_host_using_ntlm.test.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index b38b5c51b5..0f930c9c34 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -25,7 +25,7 @@ search: ' `wineventlog_security` EventCode=4648 | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 - `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter`' + | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled. known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index f2afbfa96a..83cf472818 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -23,8 +23,8 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Addr | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1  - | `multiple_users_remotely_failing_to_authenticate_from_host_filter`' + | search isOutlier=1 + | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled. known_false_positives: A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. diff --git a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml b/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml index 85ad3e65d3..06f44387f7 100644 --- a/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml +++ b/tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog \ No newline at end of file