mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'develop' into TR_2410_Domain_Controller_Attacks
This commit is contained in:
Bhavin Patel
@@ -12,35 +12,14 @@ ES_APP_NAME = "SPLUNK_ES_CONTENT_UPDATE"
|
||||
setup_schema = {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"branch": {
|
||||
"type": "string",
|
||||
"default": "develop"
|
||||
},
|
||||
"commit_hash": {
|
||||
"type": ["string", "null"],
|
||||
"default": None
|
||||
},
|
||||
|
||||
"container_tag": {
|
||||
"type": "string",
|
||||
"default": "latest"
|
||||
},
|
||||
|
||||
"no_interactive_failure": {
|
||||
"type": "boolean",
|
||||
"default": False
|
||||
},
|
||||
|
||||
"interactive": {
|
||||
"type": "boolean",
|
||||
"default": False
|
||||
},
|
||||
|
||||
"branch": {"type": "string", "default": "develop"},
|
||||
"commit_hash": {"type": ["string", "null"], "default": None},
|
||||
"container_tag": {"type": "string", "default": "latest"},
|
||||
"no_interactive_failure": {"type": "boolean", "default": False},
|
||||
"interactive": {"type": "boolean", "default": False},
|
||||
"detections_list": {
|
||||
"type": ["array", "null"],
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"items": {"type": "string"},
|
||||
"default": None,
|
||||
},
|
||||
"apps": {
|
||||
@@ -51,115 +30,116 @@ setup_schema = {
|
||||
"type": "object",
|
||||
"additionalProperties": False,
|
||||
"properties": {
|
||||
"app_number": {
|
||||
"type": ["integer", "null"]
|
||||
},
|
||||
"app_version": {
|
||||
"type": ["string", "null"]
|
||||
},
|
||||
"local_path": {
|
||||
"type": ["string", "null"]
|
||||
},
|
||||
"http_path": {
|
||||
"type": ["string", "null"]
|
||||
}
|
||||
"app_number": {"type": ["integer", "null"]},
|
||||
"app_version": {"type": ["string", "null"]},
|
||||
"local_path": {"type": ["string", "null"]},
|
||||
"http_path": {"type": ["string", "null"]},
|
||||
},
|
||||
"anyOf": [
|
||||
{"required": ["local_path"]},
|
||||
{"required": ["http_path"]},
|
||||
{"required": ["app_number", "app_version"]},
|
||||
]
|
||||
],
|
||||
}
|
||||
},
|
||||
"default": {
|
||||
|
||||
# The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
|
||||
"Splunk Add-on for CrowdStrike FDR": {
|
||||
"app_number": 5579,
|
||||
"app_version": "1.2.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz"
|
||||
},
|
||||
"app_version": "1.3.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz",
|
||||
},
|
||||
"ADD_ON_FOR_LINUX_SYSMON": {
|
||||
"app_number": 6176,
|
||||
"app_version": "1.0.4",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
|
||||
},
|
||||
ES_APP_NAME: {
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz",
|
||||
},
|
||||
"SPLUNK_TA_FIX_WINDOWS": {
|
||||
"app_number": 9999,
|
||||
"app_version": "1.0.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz",
|
||||
},
|
||||
"SPLUNK_TA_FOR_IIS": {
|
||||
"app_number": 3185,
|
||||
"app_version": "1.2.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz",
|
||||
},
|
||||
ES_APP_NAME: {
|
||||
"app_number": 3449,
|
||||
"app_version": None,
|
||||
"local_path": None
|
||||
},
|
||||
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
|
||||
"local_path": None,
|
||||
},
|
||||
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
|
||||
"app_number": 2757,
|
||||
"app_version": "7.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
|
||||
},
|
||||
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
|
||||
"app_version": "8.0.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz",
|
||||
},
|
||||
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
|
||||
"app_number": 2882,
|
||||
"app_version": "3.0.2",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
|
||||
"app_version": "4.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
|
||||
"app_number": 3719,
|
||||
"app_version": "1.3.2",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
|
||||
"app_number": 4055,
|
||||
"app_version": "4.0.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
|
||||
"app_version": "4.2.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
|
||||
"app_number": 742,
|
||||
"app_version": "8.5.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_NGINX": {
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_NGINX": {
|
||||
"app_number": 3258,
|
||||
"app_version": "3.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
|
||||
"app_version": "3.2.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
|
||||
"app_number": 5238,
|
||||
"app_version": "8.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
|
||||
"app_number": 5234,
|
||||
"app_version": "8.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_SYSMON": {
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_SYSMON": {
|
||||
"app_number": 5709,
|
||||
"app_version": "3.0.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
|
||||
"app_version": "3.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
|
||||
"app_number": 833,
|
||||
"app_version": "8.6.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz"
|
||||
},
|
||||
"SPLUNK_APP_FOR_STREAM": {
|
||||
"app_version": "8.8.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz",
|
||||
},
|
||||
"SPLUNK_APP_FOR_STREAM": {
|
||||
"app_number": 1809,
|
||||
"app_version": "8.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
|
||||
},
|
||||
"SPLUNK_COMMON_INFORMATION_MODEL": {
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz",
|
||||
},
|
||||
"SPLUNK_COMMON_INFORMATION_MODEL": {
|
||||
"app_number": 1621,
|
||||
"app_version": "5.0.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
|
||||
},
|
||||
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
|
||||
"app_version": "5.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz",
|
||||
},
|
||||
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
|
||||
"app_number": 2890,
|
||||
"app_version": "5.3.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
|
||||
},
|
||||
"SPLUNK_TA_FOR_ZEEK": {
|
||||
"app_version": "5.4.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz",
|
||||
},
|
||||
"SPLUNK_TA_FOR_ZEEK": {
|
||||
"app_number": 5466,
|
||||
"app_version": "1.0.5",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
|
||||
},
|
||||
"URL_TOOLBOX": {
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz",
|
||||
},
|
||||
"URL_TOOLBOX": {
|
||||
"app_number": 2734,
|
||||
"app_version": "1.9.2",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
|
||||
@@ -171,100 +151,61 @@ setup_schema = {
|
||||
},
|
||||
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
|
||||
"app_number": 3110,
|
||||
"app_version": "4.5.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
|
||||
"app_version": "4.5.2",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
|
||||
"app_number": 3088,
|
||||
"app_version": "4.0.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
|
||||
"app_version": "4.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz",
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
|
||||
"app_number": 3110,
|
||||
"app_version": "2.3.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz"
|
||||
}
|
||||
|
||||
}
|
||||
"app_version": "2.4.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz",
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
"mode": {
|
||||
"type": "string",
|
||||
"enum": ["changes", "selected", "all"],
|
||||
"default": "changes"
|
||||
},
|
||||
|
||||
"num_containers": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"default": 1
|
||||
},
|
||||
|
||||
"persist_security_content": {
|
||||
"type": "boolean",
|
||||
"default": False
|
||||
},
|
||||
|
||||
"pr_number": {
|
||||
"type": ["integer", "null"],
|
||||
"default": None
|
||||
},
|
||||
|
||||
"reuse_image": {
|
||||
"type": "boolean",
|
||||
"default": True
|
||||
},
|
||||
|
||||
"show_splunk_app_password": {
|
||||
"type": "boolean",
|
||||
"default": False
|
||||
|
||||
},
|
||||
|
||||
"splunkbase_username": {
|
||||
"type": ["string", "null"],
|
||||
"default": None
|
||||
},
|
||||
"splunkbase_password": {
|
||||
"type": ["string", "null"],
|
||||
"default": None
|
||||
},
|
||||
"splunk_app_password": {
|
||||
"type": ["string", "null"],
|
||||
"default": None
|
||||
"default": "changes",
|
||||
},
|
||||
"num_containers": {"type": "integer", "minimum": 1, "default": 1},
|
||||
"persist_security_content": {"type": "boolean", "default": False},
|
||||
"pr_number": {"type": ["integer", "null"], "default": None},
|
||||
"reuse_image": {"type": "boolean", "default": True},
|
||||
"show_splunk_app_password": {"type": "boolean", "default": False},
|
||||
"splunkbase_username": {"type": ["string", "null"], "default": None},
|
||||
"splunkbase_password": {"type": ["string", "null"], "default": None},
|
||||
"splunk_app_password": {"type": ["string", "null"], "default": None},
|
||||
"splunk_container_apps_directory": {
|
||||
"type": "string",
|
||||
"default": "/opt/splunk/etc/apps"
|
||||
"default": "/opt/splunk/etc/apps",
|
||||
},
|
||||
"local_base_container_name": {
|
||||
"type": "string",
|
||||
"default": "splunk_test_%d"
|
||||
},
|
||||
|
||||
"mock": {
|
||||
"type": "boolean",
|
||||
"default": False
|
||||
},
|
||||
|
||||
"local_base_container_name": {"type": "string", "default": "splunk_test_%d"},
|
||||
"mock": {"type": "boolean", "default": False},
|
||||
"folders": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": ["endpoint", "cloud", "network", "web", "application", "experimental"]
|
||||
"enum": [
|
||||
"endpoint",
|
||||
"cloud",
|
||||
"network",
|
||||
"web",
|
||||
"application",
|
||||
"experimental",
|
||||
],
|
||||
},
|
||||
"default": ["endpoint", "cloud", "network", "web", "application"]
|
||||
"default": ["endpoint", "cloud", "network", "web", "application"],
|
||||
},
|
||||
|
||||
"types": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": ["Anomaly", "Hunting", "TTP"]
|
||||
},
|
||||
"default": ["Anomaly", "Hunting", "TTP"]
|
||||
"items": {"type": "string", "enum": ["Anomaly", "Hunting", "TTP"]},
|
||||
"default": ["Anomaly", "Hunting", "TTP"],
|
||||
},
|
||||
}
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@@ -273,74 +214,97 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]:
|
||||
settings = json.loads(file.read())
|
||||
return validate(settings)
|
||||
except Exception as e:
|
||||
raise(e)
|
||||
raise (e)
|
||||
|
||||
|
||||
def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool:
|
||||
def check_dependencies(
|
||||
settings: dict, skip_password_accessibility_check: bool = True
|
||||
) -> bool:
|
||||
# Check complex mode dependencies
|
||||
error_free = True
|
||||
|
||||
# Make sure that all the mode arguments are sane
|
||||
if settings['mode'] == 'selected':
|
||||
if settings["mode"] == "selected":
|
||||
# Make sure that exactly one of the following fields is populated
|
||||
|
||||
if settings['detections_list'] == None:
|
||||
print("Error - mode was 'selected' but no detections_list was supplied.", file=sys.stderr)
|
||||
if settings["detections_list"] == None:
|
||||
print(
|
||||
"Error - mode was 'selected' but no detections_list was supplied.",
|
||||
file=sys.stderr,
|
||||
)
|
||||
error_free = False
|
||||
|
||||
if settings['mode'] != 'selected' and settings['detections_list'] != None:
|
||||
print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr)
|
||||
if settings["mode"] != "selected" and settings["detections_list"] != None:
|
||||
print(
|
||||
"Error - mode was not 'selected' but detections_list was supplied.",
|
||||
file=sys.stderr,
|
||||
)
|
||||
error_free = False
|
||||
|
||||
# Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed
|
||||
if skip_password_accessibility_check:
|
||||
pass
|
||||
elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False:
|
||||
elif (
|
||||
settings["interactive"] or not settings["no_interactive_failure"]
|
||||
) and settings["show_splunk_app_password"] is False:
|
||||
print("\n\n******************************************************\n\n")
|
||||
if settings['splunk_app_password'] is not None:
|
||||
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
|
||||
"and provided a password in the config file. We will NOT print this password to\n"
|
||||
"stdout. Look in the config file for this password.", file=sys.stderr)
|
||||
if settings["splunk_app_password"] is not None:
|
||||
print(
|
||||
"Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
|
||||
"and provided a password in the config file. We will NOT print this password to\n"
|
||||
"stdout. Look in the config file for this password.",
|
||||
file=sys.stderr,
|
||||
)
|
||||
else:
|
||||
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
|
||||
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"
|
||||
"to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr)
|
||||
settings['show_splunk_app_password'] = True
|
||||
print(
|
||||
"Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
|
||||
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"
|
||||
"to True for you. Otherwise, interactive mode login would be impossible.",
|
||||
file=sys.stderr,
|
||||
)
|
||||
settings["show_splunk_app_password"] = True
|
||||
print("\n\n******************************************************\n\n")
|
||||
|
||||
# Returns true if there are not errors
|
||||
return error_free
|
||||
|
||||
|
||||
def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
|
||||
def validate_and_write(
|
||||
configuration: dict,
|
||||
output_file: Union[io.TextIOWrapper, None] = None,
|
||||
strip_credentials: bool = False,
|
||||
skip_password_accessibility_check: bool = True,
|
||||
) -> tuple[Union[dict, None], dict]:
|
||||
closeFile = False
|
||||
if output_file is None:
|
||||
import datetime
|
||||
|
||||
now = datetime.datetime.now()
|
||||
configname = now.strftime('%Y-%m-%dT%H:%M:%S%z') + '-test-run.json'
|
||||
configname = now.strftime("%Y-%m-%dT%H:%M:%S%z") + "-test-run.json"
|
||||
output_file = open(configname, "w")
|
||||
closeFile = True
|
||||
|
||||
if strip_credentials:
|
||||
configuration = copy.deepcopy(configuration)
|
||||
configuration['splunkbase_password'] = None
|
||||
configuration['splunkbase_username'] = None
|
||||
configuration['container_password'] = None
|
||||
configuration['show_splunk_app_password'] = True
|
||||
configuration["splunkbase_password"] = None
|
||||
configuration["splunkbase_username"] = None
|
||||
configuration["container_password"] = None
|
||||
configuration["show_splunk_app_password"] = True
|
||||
|
||||
validated_json, setup_schema = validate(
|
||||
configuration, skip_password_accessibility_check)
|
||||
configuration, skip_password_accessibility_check
|
||||
)
|
||||
if validated_json == None:
|
||||
print("Error in the new settings! No output file written")
|
||||
else:
|
||||
print("Settings updated. Writing results to: %s" %
|
||||
(output_file.name))
|
||||
print("Settings updated. Writing results to: %s" % (output_file.name))
|
||||
try:
|
||||
output_file.write(json.dumps(
|
||||
validated_json, sort_keys=True, indent=4))
|
||||
output_file.write(json.dumps(validated_json, sort_keys=True, indent=4))
|
||||
except Exception as e:
|
||||
print("Error writing settings to %s: [%s]" % (
|
||||
output_file.name, str(e)), file=sys.stderr)
|
||||
print(
|
||||
"Error writing settings to %s: [%s]" % (output_file.name, str(e)),
|
||||
file=sys.stderr,
|
||||
)
|
||||
sys.exit(1)
|
||||
if closeFile is True:
|
||||
output_file.close()
|
||||
@@ -348,32 +312,42 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper,
|
||||
return validated_json, setup_schema
|
||||
|
||||
|
||||
def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
|
||||
def validate(
|
||||
configuration: dict, skip_password_accessibility_check: bool = True
|
||||
) -> tuple[Union[dict, None], dict]:
|
||||
# v = jsonschema.Draft201909Validator(argument_schema)
|
||||
|
||||
try:
|
||||
|
||||
validation_errors, validated_json = jsonschema_errorprinter.check_json(
|
||||
configuration, setup_schema)
|
||||
configuration, setup_schema
|
||||
)
|
||||
|
||||
if len(validation_errors) == 0:
|
||||
# check to make sure there were no complex errors
|
||||
no_complex_errors = check_dependencies(
|
||||
validated_json, skip_password_accessibility_check)
|
||||
validated_json, skip_password_accessibility_check
|
||||
)
|
||||
if no_complex_errors:
|
||||
return validated_json, setup_schema
|
||||
else:
|
||||
print("Validation failed due to error(s) listed above.",
|
||||
file=sys.stderr)
|
||||
print(
|
||||
"Validation failed due to error(s) listed above.", file=sys.stderr
|
||||
)
|
||||
return None, setup_schema
|
||||
else:
|
||||
print("[%d] failures detected during validation of the configuration!" % (
|
||||
len(validation_errors)), file=sys.stderr)
|
||||
print(
|
||||
"[%d] failures detected during validation of the configuration!"
|
||||
% (len(validation_errors)),
|
||||
file=sys.stderr,
|
||||
)
|
||||
for error in validation_errors:
|
||||
print(error, end="\n\n", file=sys.stderr)
|
||||
return None, setup_schema
|
||||
|
||||
except Exception as e:
|
||||
print("There was an error validation the configuration: [%s]" % (
|
||||
str(e)), file=sys.stderr)
|
||||
return None, setup_schema
|
||||
print(
|
||||
"There was an error validation the configuration: [%s]" % (str(e)),
|
||||
file=sys.stderr,
|
||||
)
|
||||
return None, setup_schema
|
||||
|
||||
@@ -105,27 +105,127 @@
|
||||
"app_version": "2.3.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz"
|
||||
},
|
||||
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
|
||||
"app_number": 3110,
|
||||
"app_version": "4.5.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
|
||||
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
|
||||
"app_number": 2757,
|
||||
"app_version": "8.0.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz"
|
||||
},
|
||||
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
|
||||
"app_number": 2882,
|
||||
"app_version": "4.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
|
||||
"app_number": 3719,
|
||||
"app_version": "1.3.2",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
|
||||
"app_number": 3088,
|
||||
"app_version": "4.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
|
||||
"app_number": 3110,
|
||||
"app_version": "2.4.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
|
||||
"app_number": 4055,
|
||||
"app_version": "4.2.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
|
||||
"app_number": 742,
|
||||
"app_version": "8.5.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_NGINX": {
|
||||
"app_number": 3258,
|
||||
"app_version": "3.2.1",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
|
||||
"app_number": 5238,
|
||||
"app_version": "8.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
|
||||
"app_number": 5234,
|
||||
"app_version": "8.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_SYSMON": {
|
||||
"app_number": 5709,
|
||||
"app_version": "3.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz"
|
||||
},
|
||||
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
|
||||
"app_number": 833,
|
||||
"app_version": "8.8.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz"
|
||||
},
|
||||
"SPLUNK_APP_FOR_STREAM": {
|
||||
"app_number": 1809,
|
||||
"app_version": "8.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
|
||||
},
|
||||
"SPLUNK_COMMON_INFORMATION_MODEL": {
|
||||
"app_number": 1621,
|
||||
"app_version": "5.1.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz"
|
||||
},
|
||||
"SPLUNK_ES_CONTENT_UPDATE": {
|
||||
"app_number": 3449,
|
||||
"app_version": null,
|
||||
"local_path": null
|
||||
},
|
||||
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
|
||||
"app_number": 2890,
|
||||
"app_version": "5.4.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz"
|
||||
},
|
||||
"SPLUNK_TA_FIX_WINDOWS": {
|
||||
"app_number": 9999,
|
||||
"app_version": "1.0.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
|
||||
},
|
||||
"SPLUNK_TA_FOR_IIS": {
|
||||
"app_number": 3185,
|
||||
"app_version": "1.2.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-iis_120.tgz"
|
||||
}
|
||||
},
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz"
|
||||
},
|
||||
"SPLUNK_TA_FOR_ZEEK": {
|
||||
"app_number": 5466,
|
||||
"app_version": "1.0.5",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
|
||||
},
|
||||
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
|
||||
"app_number": 3110,
|
||||
"app_version": "4.5.2",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz"
|
||||
},
|
||||
"Splunk Add-on for CrowdStrike FDR": {
|
||||
"app_number": 5579,
|
||||
"app_version": "1.3.0",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz"
|
||||
},
|
||||
"URL_TOOLBOX": {
|
||||
"app_number": 2734,
|
||||
"app_version": "1.9.2",
|
||||
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
|
||||
}
|
||||
},
|
||||
"branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
|
||||
"commit_hash": null,
|
||||
"container_tag": "latest",
|
||||
"detections_list": null,
|
||||
"folders": [
|
||||
"endpoint",
|
||||
"cloud",
|
||||
"network",
|
||||
"web",
|
||||
"application"
|
||||
"endpoint",
|
||||
"cloud",
|
||||
"network",
|
||||
"web",
|
||||
"application"
|
||||
],
|
||||
"interactive": false,
|
||||
"local_base_container_name": "splunk_test_%d",
|
||||
@@ -142,8 +242,8 @@
|
||||
"splunkbase_password": null,
|
||||
"splunkbase_username": null,
|
||||
"types": [
|
||||
"Anomaly",
|
||||
"Hunting",
|
||||
"TTP"
|
||||
"Anomaly",
|
||||
"Hunting",
|
||||
"TTP"
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -1,14 +1,14 @@
|
||||
name: Linux SSH Remote Services Script Execute
|
||||
id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3
|
||||
version: 1
|
||||
date: '2022-07-27'
|
||||
date: '2023-03-03'
|
||||
author: Michael Haag, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies SSH being utilized to move laterally and execute a script or file on the remote host.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND CommandLine IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
||||
| `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
|
||||
+75
@@ -0,0 +1,75 @@
|
||||
name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
|
||||
id: 98f22d82-9d62-11eb-9fcf-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-14'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies one source endpoint failing to authenticate
|
||||
with 30 unique disabled domain users using the Kerberos protocol within 5 minutes. This behavior could
|
||||
represent an adversary performing a Password Spraying attack against an Active Directory
|
||||
environment using Kerberos to obtain initial access or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
As attackers
|
||||
progress in a breach, mistakes will be made. In certain scenarios, adversaries may
|
||||
execute a password spraying attack against disabled users. Event 4768 is generated
|
||||
every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket
|
||||
(TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account
|
||||
disabled, expired or locked out).\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will only trigger on domain controllers, not on member servers or workstations.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source ip and attempted user accounts.'
|
||||
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
known_false_positives: A host failing to authenticate with multiple disabled domain
|
||||
users is not a common behavior for legitimate systems. Possible false positive scenarios
|
||||
include but are not limited to vulnerability scanners, multi-user systems missconfigured
|
||||
systems.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
- Active Directory Kerberos Attacks
|
||||
automated_detection_testing: passed
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential Kerberos based password spraying attack from $IpAddress$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: IpAddress
|
||||
type: Endpoint
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Status
|
||||
- TargetUserName
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+76
@@ -0,0 +1,76 @@
|
||||
name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
|
||||
id: 001266a6-9d5b-11eb-829b-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-14'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies one source endpoint failing to authenticate
|
||||
with 30 unique invalid domain users using the Kerberos protocol. This behavior could
|
||||
represent an adversary performing a Password Spraying attack against an Active Directory
|
||||
environment using Kerberos to obtain initial access or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
As attackers
|
||||
progress in a breach, mistakes will be made. In certain scenarios, adversaries may
|
||||
execute a password spraying attack using an invalid list of users. Event 4768 is
|
||||
generated every time the Key Distribution Center issues a Kerberos Ticket Granting
|
||||
Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database`
|
||||
(the attempted user is not a valid domain user).\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will only trigger on domain controllers, not on member servers or
|
||||
workstations.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source ip and attempted user accounts.'
|
||||
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
known_false_positives: A host failing to authenticate with multiple invalid domain
|
||||
users is not a common behavior for legitimate systems. Possible false positive scenarios
|
||||
include but are not limited to vulnerability scanners, multi-user systems and missconfigured
|
||||
systems.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
- Active Directory Kerberos Attacks
|
||||
automated_detection_testing: passed
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential Kerberos based password spraying attack from $IpAddress$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: IpAddress
|
||||
type: Endpoint
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Status
|
||||
- TargetUserName
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+78
@@ -0,0 +1,78 @@
|
||||
name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM
|
||||
id: 57ad5a64-9df7-11eb-a290-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-15'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies one source endpoint failing to authenticate
|
||||
with 30 unique invalid users using the NTLM protocol. This behavior could represent
|
||||
an adversary performing a Password Spraying attack against an Active Directory environment
|
||||
using NTLM to obtain initial access or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
As attackers progress
|
||||
in a breach, mistakes will be made. In certain scenarios, adversaries may execute
|
||||
a password spraying attack using an invalid list of users. Event 4776 is generated
|
||||
on the computer that is authoritative for the provided credentials. For domain accounts,
|
||||
the domain controller is authoritative. For local accounts, the local computer is
|
||||
authoritative. Error code 0xC0000064 stands for `The username you typed does not
|
||||
exist` (the attempted user is a legitimate domain user).\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will only trigger on domain controllers, not on member servers or
|
||||
workstations.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source workstation name and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
|
||||
Validation' within `Account Logon` needs to be enabled.
|
||||
known_false_positives: A host failing to authenticate with multiple invalid domain
|
||||
users is not a common behavior for legitimate systems. Possible false positive scenarios
|
||||
include but are not limited to vulnerability scanners and missconfigured systems.
|
||||
If this detection triggers on a host other than a Domain Controller, the behavior
|
||||
could represent a password spraying attack against the host's local accounts.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential NTLM based password spraying attack from $Workstation$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Workstation
|
||||
type: Endpoint
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- TargetUserName
|
||||
- Workstation
|
||||
- Status
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+78
@@ -0,0 +1,78 @@
|
||||
name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
|
||||
id: e61918fa-9ca4-11eb-836c-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-13'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies a source user failing to authenticate
|
||||
with 30 unique users using explicit credentials on a host. This behavior could represent
|
||||
an adversary performing a Password Spraying attack against an Active Directory environment
|
||||
to obtain initial access or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
Event 4648 is generated when a process
|
||||
attempts an account logon by explicitly specifying that accounts credentials. This
|
||||
event generates on domain controllers, member servers, and workstations.\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will trigger on the potenfially malicious host, perhaps controlled
|
||||
via a trojan or operated by an insider threat, from where a password spraying attack
|
||||
is being executed.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source account, attempted user accounts and the endpoint were
|
||||
the behavior was identified.'
|
||||
search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
|
||||
| bucket span=5m _time
|
||||
| stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows Event Logs from domain controllers as well as member servers and workstations.
|
||||
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
|
||||
to be enabled.
|
||||
known_false_positives: A source user failing attempting to authenticate multiple users
|
||||
on a host is not a common behavior for regular systems. Some applications, however,
|
||||
may exhibit this behavior in which case sets of users hosts can be added to an allow
|
||||
list. Possible false positive scenarios include systems where several users connect
|
||||
to like Mail servers, identity providers, remote desktop services, Citrix, etc.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
- Insider Threat
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential password spraying attack from $Computer$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Target_User_Name
|
||||
- Caller_User_Name
|
||||
- Computer
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+76
@@ -0,0 +1,76 @@
|
||||
name: Windows Multiple Users Failed To Authenticate From Host Using NTLM
|
||||
id: 7ed272a4-9c77-11eb-af22-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-13'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies one source endpoint failing to authenticate
|
||||
with 30 unique valid users using the NTLM protocol. This behavior could represent
|
||||
an adversary performing a Password Spraying attack against an Active Directory environment
|
||||
using NTLM to obtain initial access or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
Event 4776 is generated
|
||||
on the computer that is authoritative for the provided credentials. For domain accounts,
|
||||
the domain controller is authoritative. For local accounts, the local computer is
|
||||
authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted
|
||||
user is a legitimate domain user).\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will only trigger on domain controllers, not on member servers or
|
||||
workstations.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source workstation name and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
|
||||
Validation` within `Account Logon` needs to be enabled.
|
||||
known_false_positives: A host failing to authenticate with multiple valid domain users
|
||||
is not a common behavior for legitimate systems. Possible false positive scenarios
|
||||
include but are not limited to vulnerability scanners and missconfigured systems.
|
||||
If this detection triggers on a host other than a Domain Controller, the behavior
|
||||
could represent a password spraying attack against the host's local accounts.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential NTLM based password spraying attack from $Workstation$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Workstation
|
||||
type: Endpoint
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Status
|
||||
- TargetUserName
|
||||
- Workstation
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -0,0 +1,79 @@
|
||||
name: Windows Multiple Users Failed To Authenticate From Process
|
||||
id: 9015385a-9c84-11eb-bef2-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-13'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies a source process name failing to authenticate
|
||||
with 30 uniquer users. This behavior could represent an adversary performing a Password
|
||||
Spraying attack against an Active Directory environment to obtain initial access
|
||||
or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
Event 4625 generates on domain controllers, member servers,
|
||||
and workstations when an account fails to logon. Logon Type 2 describes an iteractive
|
||||
logon attempt.\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will trigger on the potenfially malicious host, perhaps controlled
|
||||
via a trojan or operated by an insider threat, from where a password spraying attack
|
||||
is being executed. This could be a domain controller as well as a member server
|
||||
or workstation.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source process name, source account and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-"
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_users_failed_to_authenticate_from_process_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows Event Logs from domain controllers aas well as member servers and workstations.
|
||||
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
|
||||
to be enabled.
|
||||
known_false_positives: A process failing to authenticate with multiple users is not
|
||||
a common behavior for legitimate user sessions. Possible false positive scenarios
|
||||
include but are not limited to vulnerability scanners and missconfigured systems.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
|
||||
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
- Insider Threat
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential password spraying attack from $Computer$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Logon_Type
|
||||
- ProcessName
|
||||
- SubjectUserName
|
||||
- TargetUserName
|
||||
- Computer
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -0,0 +1,76 @@
|
||||
name: Windows Multiple Users Failed To Authenticate Using Kerberos
|
||||
id: 3a91a212-98a9-11eb-b86a-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-08'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies one source endpoint failing to authenticate
|
||||
with 30 unique users using the Kerberos protocol. This behavior could represent
|
||||
an adversary performing a Password Spraying attack against an Active Directory environment
|
||||
using Kerberos to obtain initial access or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
Event 4771 is generated
|
||||
when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket
|
||||
(TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user
|
||||
is a legitimate domain user).\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will only trigger on domain controllers, not on member servers or
|
||||
workstations.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source ip and attempted user accounts.'
|
||||
search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
known_false_positives: A host failing to authenticate with multiple valid domain users
|
||||
is not a common behavior for legitimate systems. Possible false positive scenarios
|
||||
include but are not limited to vulnerability scanners, missconfigured systems and
|
||||
multi-user systems like Citrix farms.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11)
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
- Active Directory Kerberos Attacks
|
||||
automated_detection_testing: passed
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential Kerberos based password spraying attack from $IpAddress$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: IpAddress
|
||||
type: Endpoint
|
||||
role:
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Status
|
||||
- TargetUserName
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+77
@@ -0,0 +1,77 @@
|
||||
name: Windows Multiple Users Remotely Failed To Authenticate From Host
|
||||
id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
|
||||
version: 2
|
||||
date: '2021-04-13'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel: []
|
||||
description: 'The following analytic identifies a source host failing to authenticate
|
||||
against a remote host with 30 unique users. This behavior could represent an adversary
|
||||
performing a Password Spraying attack against an Active Directory environment to
|
||||
obtain initial access or elevate privileges.
|
||||
Active Directory environments can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold when needed.
|
||||
Event 4625 documents each and every
|
||||
failed attempt to logon to the local computer. This event generates on domain controllers,
|
||||
member servers, and workstations. Logon Type 3 describes an remote authentication
|
||||
attempt.\
|
||||
|
||||
This logic can be used for real time security monitoring as well as threat hunting exercises.
|
||||
This detection will trigger on the host that is the target of the password spraying
|
||||
attack. This could be a domain controller as well as a member server or workstation.\
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source process name, source account and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-"
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer
|
||||
| where unique_accounts > 30
|
||||
| `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows Event Logs from domain controllers as as well as member servers and workstations.
|
||||
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
|
||||
to be enabled.
|
||||
known_false_positives: A host failing to authenticate with multiple valid users against
|
||||
a remote host is not a common behavior for legitimate systems. Possible false positive
|
||||
scenarios include but are not limited to vulnerability scanners, remote administration
|
||||
tools, missconfigyred systems, etc.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1110/003/
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
|
||||
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
|
||||
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Password Spraying
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential password spraying attack on $ComputerName$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Logon_Type
|
||||
- TargetUserName
|
||||
- Computer
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+17
-15
@@ -1,7 +1,7 @@
|
||||
name: Windows Disabled Users Failing To Authenticate Kerberos
|
||||
id: 98f22d82-9d62-11eb-9fcf-acde48001122
|
||||
name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
|
||||
id: f65aa026-b811-42ab-b4b9-d9088137648f
|
||||
version: 1
|
||||
date: '2021-04-14'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source ip and attempted user accounts.'
|
||||
search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
|
||||
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
|
||||
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
|
||||
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
|
||||
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` '
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
@@ -52,19 +54,19 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential Kerberos based password spraying attack from $Client_Address$
|
||||
message: Potential Kerberos based password spraying attack from $IpAddress$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Client_Address
|
||||
- name: IpAddress
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -72,9 +74,9 @@ tags:
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Result_Code
|
||||
- Account_Name
|
||||
- Client_Address
|
||||
- Status
|
||||
- TargetUserName
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+17
-15
@@ -1,7 +1,7 @@
|
||||
name: Windows Invalid Users Failed Authentication via Kerberos
|
||||
id: 001266a6-9d5b-11eb-829b-acde48001122
|
||||
name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
|
||||
id: f122cb2e-d773-4f11-8399-62a3572d8dd7
|
||||
version: 1
|
||||
date: '2021-04-14'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source ip and attempted user accounts.'
|
||||
search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"
|
||||
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
|
||||
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
|
||||
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
|
||||
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` '
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
@@ -52,19 +54,19 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential Kerberos based password spraying attack from $Client_Address$
|
||||
message: Potential Kerberos based password spraying attack from $IpAddress$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Client_Address
|
||||
- name: IpAddress
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -72,9 +74,9 @@ tags:
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Result_Code
|
||||
- Account_Name
|
||||
- Client_Address
|
||||
- Status
|
||||
- TargetUserName
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+16
-14
@@ -1,7 +1,7 @@
|
||||
name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM
|
||||
id: 57ad5a64-9df7-11eb-a290-acde48001122
|
||||
name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
|
||||
id: 15603165-147d-4a6e-9778-bd0ff39e668f
|
||||
version: 1
|
||||
date: '2021-04-15'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -27,12 +27,14 @@ description: 'The following analytic identifies one source endpoint failing to a
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source workstation name and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure
|
||||
| bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
|
||||
as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
|
||||
as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
|
||||
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
|
||||
| bucket span=2m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`'
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
|
||||
Validation' within `Account Logon` needs to be enabled.
|
||||
@@ -54,7 +56,7 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
@@ -63,10 +65,10 @@ tags:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Source_Workstation
|
||||
- name: Workstation
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -74,9 +76,9 @@ tags:
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- action
|
||||
- Logon_Account
|
||||
- Source_Workstation
|
||||
- TargetUserName
|
||||
- Workstation
|
||||
- Status
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+17
-17
@@ -1,7 +1,7 @@
|
||||
name: Windows Users Authenticate Using Explicit Credentials
|
||||
id: e61918fa-9ca4-11eb-836c-acde48001122
|
||||
name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
|
||||
id: 14f414cf-3080-4b9b-aaf6-55a4ce947b93
|
||||
version: 1
|
||||
date: '2021-04-13'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -25,14 +25,14 @@ description: 'The following analytic identifies a source user failing to authent
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source account, attempted user accounts and the endpoint were
|
||||
the behavior was identified.'
|
||||
search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account
|
||||
= mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1)
|
||||
| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
|
||||
| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as
|
||||
tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts)
|
||||
as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3)
|
||||
search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
|
||||
| bucket span=5m _time
|
||||
| stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Computer
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` '
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows Event Logs from domain controllers as well as member servers and workstations.
|
||||
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
|
||||
@@ -56,19 +56,19 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential password spraying attack from $ComputerName$
|
||||
message: Potential password spraying attack from $Computer$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: ComputerName
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -76,9 +76,9 @@ tags:
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Security_ID
|
||||
- Account_Name
|
||||
- ComputerName
|
||||
- Target_User_Name
|
||||
- Caller_User_Name
|
||||
- Computer
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+17
-15
@@ -1,7 +1,7 @@
|
||||
name: Multiple Users Failing To Authenticate From Host Using Kerberos
|
||||
id: 3a91a212-98a9-11eb-b86a-acde48001122
|
||||
name: Windows Unusual Count Of Users Failed To Auth Using Kerberos
|
||||
id: bc9cb715-08ba-40c3-9758-6e2b26e455cb
|
||||
version: 1
|
||||
date: '2021-04-08'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -24,12 +24,14 @@ description: 'The following analytic identifies one source endpoint failing to a
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source ip and attempted user accounts.'
|
||||
search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
|
||||
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
|
||||
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
|
||||
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
|
||||
search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
|
||||
| bucket span=5m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`'
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
@@ -52,19 +54,19 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential Kerberos based password spraying attack from $Client_Address$
|
||||
message: Potential Kerberos based password spraying attack from $IpAddress$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Client_Address
|
||||
- name: IpAddress
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -72,9 +74,9 @@ tags:
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Result_Code
|
||||
- Account_Name
|
||||
- Client_Address
|
||||
- Status
|
||||
- TargetUserName
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+18
-18
@@ -1,7 +1,7 @@
|
||||
name: Multiple Users Failing To Authenticate From Process
|
||||
id: 9015385a-9c84-11eb-bef2-acde48001122
|
||||
name: Windows Unusual Count Of Users Failed To Authenticate From Process
|
||||
id: 25bdb6cb-2e49-4d34-a93c-d6c567c122fe
|
||||
version: 1
|
||||
date: '2021-04-13'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -25,14 +25,14 @@ description: 'The following analytic identifies a source process name failing to
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source process name, source account and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-"
|
||||
| bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account
|
||||
= mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name)
|
||||
as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName |
|
||||
eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
|
||||
by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3)
|
||||
search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-"
|
||||
| bucket span=2m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, SubjectUserName, Computer
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` '
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_users_failed_to_authenticate_from_process_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows Event Logs from domain controllers aas well as member servers and workstations.
|
||||
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
|
||||
@@ -55,19 +55,19 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential password spraying attack from $ComputerName$
|
||||
message: Potential password spraying attack from $Computer$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: ComputerName
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -76,10 +76,10 @@ tags:
|
||||
- _time
|
||||
- EventCode
|
||||
- Logon_Type
|
||||
- Caller_Process_Name
|
||||
- Security_ID
|
||||
- Account_Name
|
||||
- ComputerName
|
||||
- ProcessName
|
||||
- SubjectUserName
|
||||
- TargetUserName
|
||||
- Computer
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+17
-15
@@ -1,7 +1,7 @@
|
||||
name: Multiple Users Failing To Authenticate From Host Using NTLM
|
||||
id: 7ed272a4-9c77-11eb-af22-acde48001122
|
||||
name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM
|
||||
id: 6f6c8fd7-6a6b-4af9-a0e9-57cfc47a58b4
|
||||
version: 1
|
||||
date: '2021-04-13'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -25,12 +25,14 @@ description: 'The following analytic identifies one source endpoint failing to a
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source workstation name and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure
|
||||
| bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
|
||||
as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
|
||||
as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
|
||||
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
|
||||
| bucket span=2m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`'
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
|
||||
Validation` within `Account Logon` needs to be enabled.
|
||||
@@ -52,19 +54,19 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential NTLM based password spraying attack from $Source_Workstation$
|
||||
message: Potential NTLM based password spraying attack from $Workstation$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: Source_Workstation
|
||||
- name: Workstation
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -72,9 +74,9 @@ tags:
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- action
|
||||
- Logon_Account
|
||||
- Source_Workstation
|
||||
- Status
|
||||
- TargetUserName
|
||||
- Workstation
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+18
-18
@@ -1,7 +1,7 @@
|
||||
name: Multiple Users Remotely Failing To Authenticate From Host
|
||||
id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
|
||||
name: Windows Unusual Count Of Users Remotely Failed To Auth From Host
|
||||
id: cf06a0ee-ffa9-4ed3-be77-0670ed9bab52
|
||||
version: 1
|
||||
date: '2021-04-13'
|
||||
date: '2022-09-22'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Anomaly
|
||||
datamodel: []
|
||||
@@ -24,13 +24,14 @@ description: 'The following analytic identifies a source host failing to authent
|
||||
|
||||
The analytics returned fields allow analysts to investigate the event further by
|
||||
providing fields like source process name, source account and attempted user accounts.'
|
||||
search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-"
|
||||
| bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats
|
||||
dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts
|
||||
by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts)
|
||||
as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
|
||||
| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10
|
||||
and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` '
|
||||
search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-"
|
||||
| bucket span=2m _time
|
||||
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer
|
||||
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer
|
||||
| eval upperBound=(comp_avg+comp_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
|
||||
| search isOutlier=1
|
||||
| `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter` '
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows Event Logs from domain controllers as as well as member servers and workstations.
|
||||
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
|
||||
@@ -53,19 +54,19 @@ tags:
|
||||
- Stage:Initial Access
|
||||
- Stage:Privilege Escalation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential password spraying attack on $ComputerName$
|
||||
message: Potential password spraying attack on $Computer$
|
||||
mitre_attack_id:
|
||||
- T1110.003
|
||||
- T1110
|
||||
observable:
|
||||
- name: ComputerName
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- Attacker
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
@@ -74,10 +75,9 @@ tags:
|
||||
- _time
|
||||
- EventCode
|
||||
- Logon_Type
|
||||
- Security_ID
|
||||
- Account_Name
|
||||
- ComputerName
|
||||
- Source_Network_Address
|
||||
- TargetUserName
|
||||
- Computer
|
||||
- IpAddress
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
+3
-3
@@ -1,18 +1,18 @@
|
||||
attackcti==0.3.8
|
||||
docker==6.0.0
|
||||
GitPython==3.1.30
|
||||
GitPython==3.1.31
|
||||
Jinja2==3.1.2
|
||||
jsonschema==4.17.3
|
||||
mock==4.0.3
|
||||
psutil==5.9.4
|
||||
pycvesearch==1.2
|
||||
pydantic==1.10.4
|
||||
pydantic==1.10.5
|
||||
pytest==7.2.1
|
||||
PyYAML==5.4.1
|
||||
questionary==1.10.0
|
||||
requests==2.28.2
|
||||
six==1.16.0
|
||||
splunk-appinspect==2.32.0
|
||||
splunk-appinspect==2.33.0
|
||||
splunk-sdk==1.7.3
|
||||
wrapt-timeout-decorator==1.3.12.2
|
||||
xmltodict==0.13.0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
name: Active Directory Password Spraying
|
||||
id: 3de109da-97d2-11eb-8b6a-acde48001122
|
||||
version: 1
|
||||
version: 2
|
||||
date: '2021-04-07'
|
||||
author: Mauricio Velazco, Splunk
|
||||
description: Monitor for activities and techniques associated with Password Spraying
|
||||
@@ -23,9 +23,9 @@ narrative: 'In a password spraying attack, adversaries leverage one or a small l
|
||||
Specifically, this Analytic Story is focused on detecting possible Password Spraying
|
||||
attacks against Active Directory environments leveraging Windows Event Logs in the
|
||||
`Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents
|
||||
9 detection analytics which can aid defenders in identifying instances where one
|
||||
16 detection analytics which can aid defenders in identifying instances where one
|
||||
source user, source host or source process attempts to authenticate against a target
|
||||
or targets using a high, unsual, number of unique users. A user, host or process
|
||||
or targets using a high or statiscally unsual, number of unique users. A user, host or process
|
||||
attempting to authenticate with multiple users is not common behavior for legitimate
|
||||
systems and should be monitored by security teams. Possible false positive scenarios
|
||||
include but are not limited to vulnerability scanners, remote administration tools,
|
||||
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM Unit Test
|
||||
tests:
|
||||
- name: Multiple Invalid Users Failing To Authenticate From Host Using NTLM
|
||||
file: endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
name: Multiple Users Failing To Authenticate From Host Using Kerberos Unit Test
|
||||
tests:
|
||||
- name: Multiple Users Failing To Authenticate From Host Using Kerberos
|
||||
file: endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Multiple Users Failing To Authenticate From Host Using NTLM Unit Test
|
||||
tests:
|
||||
- name: Multiple Users Failing To Authenticate From Host Using NTLM
|
||||
file: endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Multiple Users Failing To Authenticate From Process Unit Test
|
||||
tests:
|
||||
- name: Multiple Users Failing To Authenticate From Process
|
||||
file: endpoint/multiple_users_failing_to_authenticate_from_process.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Multiple Users Remotely Failing To Authenticate From Host Unit Test
|
||||
tests:
|
||||
- name: Multiple Users Remotely Failing To Authenticate From Host
|
||||
file: endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Windows Disabled Users Failing To Authenticate Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Disabled Users Failing To Authenticate Kerberos
|
||||
file: endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Windows Invalid Users Failed Authentication via Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Invalid Users Failed Authentication via Kerberos
|
||||
file: endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos
|
||||
file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
|
||||
file: endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM
|
||||
file: endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
|
||||
file: endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Users Failed To Authenticate From Host Using NTLM Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Users Failed To Authenticate From Host Using NTLM
|
||||
file: endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Users Failed To Authenticate From Process Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Users Failed To Authenticate From Process
|
||||
file: endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Users Failed To Authenticate Using Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Users Failed To Authenticate Using Kerberos
|
||||
file: endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Users Remotely Failed To Authenticate From Host Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Users Remotely Failed To Authenticate From Host
|
||||
file: endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
|
||||
file: endpoint/windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
|
||||
file: endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
|
||||
file: endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
|
||||
file: endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Users Failed To Auth Using Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Users Failed To Auth Using Kerberos
|
||||
file: endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Users Failed To Authenticate From Process Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Users Failed To Authenticate From Process
|
||||
file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM
|
||||
file: endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Unusual Count Of Users Remotely Failed To Auth From Host Unit Test
|
||||
tests:
|
||||
- name: Windows Unusual Count Of Users Remotely Failed To Auth From Host
|
||||
file: endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Windows Users Authenticate Using Explicit Credentials Unit Test
|
||||
tests:
|
||||
- name: Windows Users Authenticate Using Explicit Credentials
|
||||
file: endpoint/windows_users_authenticate_using_explicit_credentials.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
Reference in New Issue
Block a user