From 0129d12a324b8cb88fbae0d16d0595f9ead594b8 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 30 Aug 2021 13:55:39 +0000 Subject: [PATCH] Added detection testing service results inGetWmiObject DS User with PowerShell Script Block --- ...t_ds_user_with_powershell_script_block.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index c344da01df..26b31ee511 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -6,18 +6,20 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a powershell command get-wmiobject function to do user enumeration to the active directory. - This command can be a normal query of a network admin but since the output of this is not so much structure and cannot give a concrete or - specific information that admin may look upon this is still a good TTP to alert some malicious activities. -search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `getwmiobject_ds_user_with_powershell_script_block_filter`' -how_to_implement: he following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. -known_false_positives: not commonly seen as a normal command from network admin but possible noise may exist. +description: This search is to detect a powershell command get-wmiobject function + to do user enumeration to the active directory. This command can be a normal query + of a network admin but since the output of this is not so much structure and cannot + give a concrete or specific information that admin may look upon this is still a + good TTP to alert some malicious activities. +search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" + Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`' +how_to_implement: he following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: not commonly seen as a normal command from network admin but + possible noise may exist. references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace @@ -37,13 +39,12 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - source:endpoint @@ -58,4 +59,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed