admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

minor

Browse Source
This commit is contained in:
patel-bhavin
2021-12-13 17:59:05 -08:00
parent df73312009
commit 166cb7d3f0
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/detect_outbound_ldap_traffic.yml
+3 -3
View File
@@ -7,11 +7,11 @@ type: Hunting
datamodel:
- Network_Traffic
description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space.
search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)`| `detect_outbound_ldap_traffic_filter`'
search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)`'
how_to_implement: 'You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek
data should also be getting ingested in JSON format and should be mapped to the The
Network Resolution and Network Traffic datamodels are in use for this search.'
known_false_positives:
known_false_positives: N/A
references:
- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
tags:
@@ -26,7 +26,7 @@ tags:
- Source:Endpoint
- Stage:Initial Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json
impact: 70
kill_chain_phases:
- Command and Control
tests/network/detect_outbound_ldap_traffic.test.yml
+1
View File
@@ -9,5 +9,6 @@ tests:
- file_name: stream_http_events.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json
sourcetype: bro:conn:json
source: /opt/malware/conn.log