Adding 2 new analytics and updating 4 others

detections/application/user_added_to_privileged_group.yml

@@ -0,0 +1,54 @@
+name: User Added to Privileged Group
+id: 187bf937-c436-4c65-bbcb-7539ffe02da1
+version: 1
+date: '2023-09-27'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- XmlWinEventLog:Security
+description: Detect users added to privileged AD Groups. 
+search: '`wineventlog_security` EventCode IN (4728)
+  | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category)
+  as user_category values(src_user_category) as src_user_category by signature, Group_Name,
+  src_user, dest
+  | lookup admon_groups_def  cn as Group_Name OUTPUT category
+  | where category="privileged" | `user_added_to_privileged_group_filter`'
+how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. 
+  See splunkbase for further details.
+known_false_positives: None
+references:
+- https://splunkbase.splunk.com/app/6853
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: Endpoint
+  confidence: 100
+  impact: 50
+  message: $user$ was added to privileged AD Group $Group_Name$ by $src_user$
+  mitre_attack_id:
+  - T1098
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 50
+  required_fields:
+  - EventCode
+  - user
+  - src_user
+  - signature
+  - Group_Name
+  - dest
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/endpoint/detect_new_local_admin_account.yml

@@ -10,10 +10,11 @@ description: This search looks for newly created accounts that have been elevate
 data_source:
 - Windows Security 4732
 - Windows Security 4720
-search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators)
-  | transaction member_id connected=false maxspan=180m | rename member_id as user
-  | stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`'
+search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators) 
+| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest
+| where evCount=2 AND duration<7200
+| fields - evCount, duration
+| `detect_new_local_admin_account_filter`'
 how_to_implement: You must be ingesting Windows event logs using the Splunk Windows
   TA and collecting event code 4720 and 4732
 known_false_positives: The activity may be legitimate. For this reason, it's best
@@ -70,3 +71,7 @@ tests:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/xml-windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

detections/endpoint/windows_ad_domain_replication_acl_addition.yml

@@ -4,8 +4,9 @@ version: 1
 date: "2022-11-18"
 author: Dean Luxton
 type: TTP
-status: experimental
-data_source: []
+status: production
+data_source:
+- Windows Security 5136
 description:
   This analytic detects the addition of the permissions necessary to perform a DCSync attack.
   In order to replicate AD objects, the initiating user or computer must have the following permissions on the domain.
@@ -13,9 +14,19 @@ description:
   - DS-Replication-Get-Changes-All
   Certain Sync operations may require the additional permission of DS-Replication-Get-Changes-In-Filtered-Set.
   By default, adding DCSync permissions via the Powerview Add-ObjectACL operation adds all 3. This alert identifies where this trifecta has been met, and also where just the base level requirements have been met.
-search: '`wineventlog_security`  | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?P<DSRGetChangesFiltered_user_sid>S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)"| table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid| mvexpand DSRGetChanges_user_sid| eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false")| where minDCSyncPermissions="true" | lookup identity_lookup_expanded  objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user | rename DSRGetChanges_user_sid as userSid | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet| `windows_ad_domain_replication_acl_addition_filter`'
-how_to_implement:
-  To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting
+search: '`wineventlog_security` EventCode=5136
+  | rex field=AttributeValue max_match=10000 "OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;(?P<DSRGetChanges_user_sid>S-1-[ 0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[ 1-9]\d{3})\)"
+  | rex field=AttributeValue max_match=10000 "OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;(?P<DSRGetChangesAll_user_sid>S-1-[ 0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[ 1-9]\d{3})\)"
+  | rex field=AttributeValue max_match=10000 "OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?P<DSRGetChangesFiltered_user_sid>S-1-[ 0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[ 1-9]\d{3})\)"
+  | table _time dest src_user DSRGetChanges_user_sid DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid\
+  | mvexpand DSRGetChanges_user_sid
+  | eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,"true","false"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,"true","false")
+  | where minDCSyncPermissions="true"
+  | lookup identity_lookup_expanded objectSid as DSRGetChanges_user_sid OUTPUT sAMAccountName as user
+  | rename DSRGetChanges_user_sid as userSid
+  | stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet
+  | `windows_ad_domain_replication_acl_addition_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting
   `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to  `Write All Properties`
   applied to the domain root and all descendant objects. Once the necessary logging has been enabled, enumerate the domain policy to verify if existing
   accounts with access need to be whitelisted, or revoked. Assets and Identities is also leveraged to automatically translate the objectSid into username.

detections/endpoint/windows_admon_default_group_policy_object_modified.yml

@@ -11,9 +11,9 @@ description: The following analytic leverages Splunks Admon to identify the modi
   The default domain policy is linked to all users and computers by default. An adversary who has obtained privileged access to an Active Directory network may modify the default group 
   policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the modification of the default GPOs.
 search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy")
-  | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+  | appendpipe [
+  | map search="search `wineventlog_security` EventCode=5136  AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$" | rename AttributeValue as displayName] 
+  | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName
   | `windows_admon_default_group_policy_object_modified_filter`'
 how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here
   https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory
@@ -58,4 +58,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log
     source: ActiveDirectory
-    sourcetype: ActiveDirectory
+    sourcetype: ActiveDirectory

detections/endpoint/windows_admon_group_policy_object_created.yml

@@ -11,9 +11,9 @@ description: The following analytic leverages Splunks Admon to identify the crea
   deploy malware across an Active Directory network. As an example, the Lockbit ransomware malware will create new group policies on the domain controller that are then pushed out to every device on the network.
   Security teams should monitor the creation of new Group Policy Objects.
 search: ' `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object"
-  | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+  | appendpipe [
+  | map search="search `wineventlog_security` EventCode=5136  AttributeSyntaxOID=2.5.5.12 AttributeValue=$displayName$" | rename AttributeValue as displayName] 
+  | stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName 
   | `windows_admon_group_policy_object_created_filter`'
 how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here
   https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory

detections/endpoint/windows_vulnerable_driver_installed.yml

@@ -0,0 +1,60 @@
+name: Windows Vulnerable Driver Installed
+id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f
+version: 1
+date: '2023-09-27'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- XmlWinEventLog System EventCode 7045
+description: The following analytic utilises a known list of vulnerable Windows drivers
+  to help defenders find potential persistence or privelege escalation via a vulnerable
+  driver. This analytic uses native windows system service install events to capture when the vulnerable driver is installed. 
+  A known gap with this lookup is that it does not use the hash or known signer of the vulnerable driver
+  therefore it is up to the defender to identify version and signing info and confirm
+  it is a vulnerable driver.
+  This detection is a winventlog copy of the Sysmon driver loaded detection written by Michael Haag. 
+search: '`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver"
+  | table _time dest EventCode ImagePath ServiceName ServiceType
+  | lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description
+  | search is_driver = TRUE  | `windows_vulnerable_driver_installed`'
+how_to_implement: Ensure the Splunk is collecting XmlWinEventLog:System events and the EventCode 7045 is being ingested. 
+known_false_positives: False positives may be present. Drill down into the driver
+  further by version number and cross reference by signer. Review the reference material
+  in the lookup.
+references:
+- https://loldrivers.io/
+- https://github.com/SpikySabra/Kernel-Cactus
+- https://github.com/wavestone-cdt/EDRSandblast
+- https://research.splunk.com/endpoint/a2b1f1ef-221f-4187-b2a4-d4b08ec745f4/
+- https://www.splunk.com/en_us/blog/security/these-are-the-drivers-you-are-looking-for-detect-and-prevent-malicious-drivers.html
+tags:
+  analytic_story:
+  - Windows Drivers
+  asset_type: Endpoint
+  confidence: 50
+  impact: 100
+  message: Potentially vulnerable/malicious driver ($driver_name$) has been installed on $dest$
+  mitre_attack_id:
+  - T1543.003
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 50
+  required_fields:
+  - ServiceType
+  - driver_name
+  security_domain: endpoint
+tests:
+  - name: True Positive Test
+    attack_data:
+      - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-system.log
+        source: XmlWinEventLog:System
+        sourcetype: XmlWinEventLog
+        update_timestamp: true