From 166cb7d3f040ae6d40ce237b77d32d26afb1ba1b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 13 Dec 2021 17:59:05 -0800 Subject: [PATCH] minor --- detections/network/detect_outbound_ldap_traffic.yml | 6 +++--- tests/network/detect_outbound_ldap_traffic.test.yml | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 458fdf9074..e969f058bf 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -7,11 +7,11 @@ type: Hunting datamodel: - Network_Traffic description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. -search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)`| `detect_outbound_ldap_traffic_filter`' +search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip | `security_content_ctime(latest_time)` | `security_content_ctime(earliest_time)`' how_to_implement: 'You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format and should be mapped to the The Network Resolution and Network Traffic datamodels are in use for this search.' -known_false_positives: +known_false_positives: N/A references: - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ tags: @@ -26,7 +26,7 @@ tags: - Source:Endpoint - Stage:Initial Access dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json impact: 70 kill_chain_phases: - Command and Control diff --git a/tests/network/detect_outbound_ldap_traffic.test.yml b/tests/network/detect_outbound_ldap_traffic.test.yml index 759b074d39..e671ebba06 100644 --- a/tests/network/detect_outbound_ldap_traffic.test.yml +++ b/tests/network/detect_outbound_ldap_traffic.test.yml @@ -9,5 +9,6 @@ tests: - file_name: stream_http_events.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json sourcetype: bro:conn:json + source: /opt/malware/conn.log \ No newline at end of file