admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'labeled_data_for_ml' of github.com:splunk/security_content into labeled_data_for_ml

Browse Source
This commit is contained in:
P4T12ICK
2021-07-06 10:57:48 +02:00
parent 74214a1339 aa6519c490
commit 182bdec5fd
207 changed files with 135287 additions and 111340 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.circleci/config.yml
+12 -21
View File
@@ -24,23 +24,11 @@ apt-run: &apt-install
command: |
sudo apt update -qq
sudo apt install -y python-dev python3-dev jq -qq
# install go for other testing tools
# but first lets clean up the env
if [ -f goinstall.sh ]; then
rm goinstall.sh
fi
if [ -d ~/.go ]; then
rm -rf ~/.go
fi
wget https://raw.githubusercontent.com/canha/golang-tools-install-script/master/goinstall.sh
sudo chown circleci goinstall.sh
chmod +x goinstall.sh
./goinstall.sh
executors:
content-executor:
docker:
- image: circleci/python:latest
- image: cimg/python:3.9.5-browsers
working_directory: ~/repo
jobs:
@@ -81,6 +69,11 @@ jobs:
cd security-content
source venv/bin/activate
python contentctl.py --path . --verbose validate
- run:
name: get cti repo for mitre context
command: |
cd security-content
git clone https://github.com/mitre/cti.git
- run:
name: generate documentation
command: |
@@ -188,8 +181,6 @@ jobs:
name: install splunk packaging toolkit (slim)
command: |
cd ~/slim-latest
sudo pip install --upgrade pip setuptools
sudo pip install virtualenv
virtualenv --python=/usr/bin/python2.7 --clear venv
source venv/bin/activate
pip install semantic_version
@@ -244,7 +235,7 @@ jobs:
name: submit saaws package to appinspect API
command: |
cd security-content/bin
./appinspect.sh ~/ DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD
./appinspect.sh ~/ DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD
- store_artifacts:
path: ~/report
destination: report/
@@ -279,6 +270,11 @@ jobs:
virtualenv --python=/usr/bin/python3 --clear venv
source venv/bin/activate
pip install -q -r requirements.txt
- run:
name: get cti repo for mitre context
command: |
cd security-content
git clone https://github.com/mitre/cti.git
- run:
name: run doc-gen
command: |
@@ -291,11 +287,6 @@ jobs:
cd security-content
source venv/bin/activate
python bin/pretty_yaml.py --path . -v
- run:
name: get cti repo for mitre-maps
command: |
cd security-content
git clone https://github.com/mitre/cti.git
- run:
name: run generate-actors-map
command: |
automated_detection_testing/requirements.txt
+3 -3
View File
@@ -10,10 +10,10 @@ azure-core==1.14.0
azure-identity==1.6.0
azure-mgmt-compute==20.0.0
azure-mgmt-core==1.2.1
azure-mgmt-network==16.0.0
azure-mgmt-network==19.0.0
azure-mgmt-resource==17.0.0
bcrypt==3.2.0
boto3==1.17.74
boto3==1.17.104
botocore==1.20.74
certifi==2020.12.5
cffi==1.14.5
@@ -36,8 +36,8 @@ lockfile==0.12.2
MarkupSafe==1.1.1
mock==4.0.3
more-itertools==8.7.0
nodeenv==1.6.0
mysql-connector-python==8.0.25
nodeenv==1.3.4
ntlm-auth==1.5.0
packaging==20.9
path==15.1.2
bin/doc_gen.py
+25 -21
View File
@@ -6,35 +6,39 @@ import re
from os import path, walk
import json
from jinja2 import Environment, FileSystemLoader
from pyattck import Attck
import datetime
from stix2 import FileSystemSource
from stix2 import Filter
def get_all_techniques(projects_path):
path_cti = path.join(projects_path,'cti/enterprise-attack')
fs = FileSystemSource(path_cti)
all_techniques = get_techniques(fs)
return all_techniques
def get_techniques(src):
filt = [Filter('type', '=', 'attack-pattern')]
return src.query(filt)
def mitre_attack_object(technique, attack):
mitre_attack = dict()
mitre_attack['technique_id'] = technique.id
mitre_attack['technique'] = technique.name
mitre_attack['technique_id'] = technique["external_references"][0]["external_id"]
mitre_attack['technique'] = technique["name"]
# process tactics
tactics = []
for tactic in technique.tactics:
tactics.append(tactic.name)
if 'kill_chain_phases' in technique:
for tactic in technique['kill_chain_phases']:
if tactic['kill_chain_name'] == 'mitre-attack':
tactic = tactic['phase_name'].replace('-', ' ')
tactics.append(tactic.title())
mitre_attack['tactic'] = tactics
return mitre_attack
def get_mitre_enrichment_new(attack, mitre_attack_id):
for technique in attack.enterprise.techniques:
apt_groups = []
if '.' in mitre_attack_id:
for subtechnique in technique.subtechniques:
if mitre_attack_id == subtechnique.id:
mitre_attack = mitre_attack_object(subtechnique, attack)
return mitre_attack
elif mitre_attack_id == technique.id:
for technique in attack:
if mitre_attack_id == technique["external_references"][0]["external_id"]:
mitre_attack = mitre_attack_object(technique, attack)
return mitre_attack
return []
@@ -43,7 +47,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
manifest_files = []
for root, dirs, files in walk(REPO_PATH + '/stories'):
for file in files:
if file.endswith(".yml"):
if file.endswith(".yml") and root == './stories':
manifest_files.append((path.join(root, file)))
stories = []
@@ -167,7 +171,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messages, VERBOSE):
types = ["endpoint", "application", "cloud", "network", "web", "experimental", "deprecated"]
types = ["endpoint", "application", "cloud", "network", "web", "experimental"]
manifest_files = []
for t in types:
for root, dirs, files in walk(REPO_PATH + '/detections/' + t):
@@ -259,11 +263,11 @@ if __name__ == "__main__":
if VERBOSE:
print("getting mitre enrichment data from cti")
attack = Attck()
techniques = get_all_techniques(REPO_PATH)
messages = []
sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messages, VERBOSE)
sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_detections, messages, VERBOSE)
sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, messages, VERBOSE)
sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, sorted_detections, messages, VERBOSE)
# print all the messages from generation
for m in messages:
bin/generate.py
+99 -21
View File
@@ -25,11 +25,21 @@ def load_objects(file_path, VERBOSE, REPO_PATH):
files.append(load_file(file))
return files
def process_deprecated(file,file_path):
DESCRIPTION_ANNOTATION = "WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. "
if 'deprecated' in file_path:
file['deprecated'] = True
file['description'] = DESCRIPTION_ANNOTATION + file['description']
return file
def load_file(file_path):
with open(file_path, 'r', encoding="utf-8") as stream:
try:
file = list(yaml.safe_load_all(stream))[0]
# mark any files that have been deprecated
file = process_deprecated(file,file_path)
except yaml.YAMLError as exc:
print(exc)
sys.exit("ERROR: reading {0}".format(file_path))
@@ -76,6 +86,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
@return: the savedsearches.conf file located in package/default/
'''
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
@@ -297,6 +308,83 @@ def custom_jinja2_enrichment_filter(string, object):
return customized_string
def add_annotations(detection):
# used for upstream processing of risk scoring annotations in ECSU
# this is not currently compatible with newer instances of ESCU (6.3.0+)
# we are duplicating the code block above for now and just changing variable names to make future
# changes to this data structure separate from the mappings generation
# @todo expose the JSON data structure for newer risk type
annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence']
savedsearch_annotations = {}
for key in annotation_keys:
if key == 'mitre_attack':
if 'mitre_attack_id' in detection['tags']:
savedsearch_annotations[key] = detection['tags']['mitre_attack_id']
else:
if key in detection['tags']:
savedsearch_annotations[key] = detection['tags'][key]
detection['savedsearch_annotations'] = savedsearch_annotations
return detection
def add_rba(detection):
# removed since this is causing a duplicate bug in ES 6.4+
# if 'risk_object' in detection['tags']:
# detection['risk_object'] = detection['tags']['risk_object']
# if 'risk_object_type' in detection['tags']:
# detection['risk_object_type'] = detection['tags']['risk_object_type']
if 'risk_score' in detection['tags']:
detection['risk_score'] = detection['tags']['risk_score']
# grab risk message
if 'message' in detection['tags']:
detection['risk_message'] = detection['tags']['message']
risk_objects = []
risk_object_user_types = {'user', 'username', 'email address'}
risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'}
if 'observable' in detection['tags']:
# go through each obervable
for entity in detection['tags']['observable']:
risk_object = dict()
# determine if is a user type
if entity['type'].lower() in risk_object_user_types:
risk_object['risk_object_type'] = 'user'
detection['risk_object_type'] = 'user'
for r in entity['role']:
if 'attacker' == r.lower():
# if the role is an attacker this entity is also a threat object
risk_object['threat_object_field'] = entity['name']
risk_object['threat_object_type'] = entity['type'].lower()
risk_objects.append(risk_object)
# determine if is a system type
elif entity['type'].lower() in risk_object_system_types:
risk_object['risk_object_type'] = 'system'
detection['risk_object_type'] = 'system'
for r in entity['role']:
if 'attacker' == r.lower():
# if the role is an attacker this entity is also a threat object
risk_object['threat_object_field'] = entity['name']
risk_object['threat_object_type'] = entity['type'].lower()
risk_objects.append(risk_object)
# if is not a system or user, it is a threat object
else:
risk_object['threat_object_field'] = entity['name']
risk_object['threat_object_type'] = entity['type'].lower()
risk_objects.append(risk_object)
continue
detection['risk_object'] = entity['name']
risk_object['risk_object_field'] = entity['name']
risk_object['risk_score'] = detection['risk_score']
risk_objects.append(risk_object)
detection['risk'] = risk_objects
return detection
def prepare_detections(detections, deployments, OUTPUT_PATH):
for detection in detections:
@@ -322,30 +410,14 @@ def prepare_detections(detections, deployments, OUTPUT_PATH):
mappings[key] = detection['tags'][key]
detection['mappings'] = mappings
# used for upstream processing of risk scoring annotations in ECSU
# this is not currently compatible with newer instances of ESCU (6.3.0+)
# we are duplicating the code block above for now and just changing variable names to make future
# changes to this data structure separate from the mappings generation
# @todo expose the JSON data structure for newer risk type
annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story']
savedsearch_annotations = {}
for key in annotation_keys:
if key == 'mitre_attack':
if 'mitre_attack_id' in detection['tags']:
savedsearch_annotations[key] = detection['tags']['mitre_attack_id']
else:
if key in detection['tags']:
savedsearch_annotations[key] = detection['tags'][key]
detection['savedsearch_annotations'] = savedsearch_annotations
detection = add_annotations(detection)
detection = add_rba(detection)
if 'risk_object' in detection['tags']:
detection['risk_object'] = detection['tags']['risk_object']
if 'risk_object_type' in detection['tags']:
detection['risk_object_type'] = detection['tags']['risk_object_type']
if 'risk_score' in detection['tags']:
detection['risk_score'] = detection['tags']['risk_score']
# add additional metadata
if 'product' in detection['tags']:
detection['product'] = detection['tags']['product']
# turn all SAAWS detections
if (OUTPUT_PATH) == 'dist/saaws':
detection['disabled'] = 'false'
@@ -567,10 +639,16 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
workbench_panels_objects = generate_workbench_panels(objects["response_tasks"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
# calculate deprecation totals
deprecated = []
for d in objects['detections']:
if 'deprecated' in d:
deprecated.append(d)
if VERBOSE:
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), story_path))
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
print("{0} response tasks have been successfully written to {1}".format(len(objects["response_tasks"]), detection_path))
print("{0} baselines have been successfully written to {1}".format(len(objects["baselines"]), detection_path))
print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
bin/jinja2_templates/detection.j2
+13
View File
@@ -36,3 +36,16 @@ tags:
required_fields:
- _time
security_domain: {{security_domain}}
impact: {{impact}}
confidence: {{ confidence }}
# (impact * confidence)/100
risk_score: {{risk_score}}
context:
{% for context in contexts -%}
- {{contexts}}
{% endfor -%}
message: {{risk_message}}
observable:
{% for observable in observables -%}
- {{observable}}
{% endfor -%}
bin/jinja2_templates/savedsearches.j2
+10 -4
View File
@@ -44,11 +44,13 @@ action.escu.providing_technologies = []
{% endif %}
{% if detection.tags.analytic_story is defined %}
action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
{% if detection.tags.risk_object is defined %}
{% if detection.risk_score is defined %}
action.risk = 1
action.risk.param._risk_object = {{ detection.tags.risk_object }}
action.risk.param._risk_object_type = {{ detection.tags.risk_object_type }}
action.risk.param._risk_score = {{ detection.tags.risk_score }}
action.risk.param._risk_object = {{ detection.risk_object }}
action.risk.param._risk_object_type = {{ detection.risk_object_type }}
action.risk.param._risk_score = {{ detection.risk_score }}
action.risk.param._risk_message = {{ detection.risk_message }}
action.risk.param._risk = {{ detection.risk | tojson }}
action.risk.param.verbose = 0
{% endif %}
{% else %}
@@ -58,7 +60,11 @@ cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
action.correlationsearch.enabled = 1
{% if detection.deprecated is defined %}
action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule
{% else %}
action.correlationsearch.label = ESCU - {{ detection.name }} - Rule
{% endif %}
action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }}
{% if detection.deployment.scheduling.schedule_window is defined %}
schedule_window = {{ detection.deployment.scheduling.schedule_window }}
bin/newcontent.py
+2 -2
View File
@@ -219,7 +219,7 @@ def detection_wizard(security_content_path,type,TEMPLATE_PATH):
output_path = path.join(security_content_path, 'detections/' + detection_kind + '/' + detection_file_name + '.yml')
output = template.render(uuid=uuid.uuid1(), date=date.today().strftime('%Y-%m-%d'),
author=answers['detection_author'], name=answers['detection_name'],
description='UPDATE_DESCRIPTION', how_to_implement='UPDATE_HOW_TO_IMPLEMENT', known_false_positives='UPDATE_KNOWN_FALSE_POSITIVES',
description='|\n\tUPDATE_DESCRIPTION\n\tWHAT IS THIS?\n\tWHAT DOES IT LOOK LIKE?\n\tHOW DO YOU TRIAGE IT?', how_to_implement='UPDATE_HOW_TO_IMPLEMENT', known_false_positives='UPDATE_KNOWN_FALSE_POSITIVES',
references='',datamodels=answers['datamodels'],
search= answers['detection_search'] + ' | `' + detection_file_name + '_filter`',
type=answers['detection_type'], analytic_story_name='UPDATE_STORY_NAME', mitre_attack_id=mitre_attack_id,
@@ -413,7 +413,7 @@ def create_example(security_content_path,type, TEMPLATE_PATH):
output_path = path.join(security_content_path, 'detections/endpoint/' + detection_name)
output = template.render(uuid=uuid.uuid1(), date=date.today().strftime('%Y-%m-%d'),
author='UPDATE_AUTHOR', name=getpass.getuser().capitalize() + ' ' + type.capitalize(),
description='UPDATE_DESCRIPTION',
description='|\n\tUPDATE_DESCRIPTION\n\tWHAT IS THIS?\n\tWHAT DOES IT LOOK LIKE?\n\tHOW DO YOU TRIAGE IT?',
how_to_implement='UPDATE_HOW_TO_IMPLENT',
known_false_positives='UPDATE_KNOWN_FALSE_POSITIVES',
references=['https://html5zombo.com/'],
bin/reporting.py
+12 -4
View File
@@ -30,6 +30,7 @@ def load_file(file_path):
def main(args):
print("generated reporting information for our detections")
# process all detections
REPO_PATH = os.path.join(os.path.dirname(__file__), '../')
@@ -41,11 +42,15 @@ def main(args):
detections.extend(load_objects("detections/web/*.yml", REPO_PATH))
detections_all = detections.copy()
detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH))
#lets exclude all deprecated detections from our reporting and experimental
# detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
# detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH))
count_detections_all = len(detections_all)
print("detection count: {}".format(count_detections_all))
tests = load_objects("tests/*/*.yml", REPO_PATH)
print("test count: {}".format(len(tests)))
counter_tests=0
counter_detection=0
@@ -56,8 +61,9 @@ def main(args):
for test in tests:
counter_tests=counter_tests+1
detection_coverage = "{:.0%}".format(counter_tests/counter_detection)
detection_coverage = "{:.0%}".format(counter_detection/counter_tests)
print("detection_coverage {}".format(detection_coverage))
TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')
OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting')
@@ -67,12 +73,14 @@ def main(args):
output = template.render(detection_coverage=detection_coverage)
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
print("writting detection coverage report: {}".format(output_path))
template = j2_env.get_template('detection_count.j2')
output_path = path.join(OUTPUT_PATH, 'detection_count.svg')
output = template.render(detection_count=count_detections_all)
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
print("writting detection count report: {}".format(output_path))
if __name__ == "__main__":
bin/reporting/detection_count.svg
+1 -1
View File
@@ -13,6 +13,6 @@
<rect rx="3" width="105" height="20" fill="url(#a)"/>
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
<text x="30" y="14">detections</text>
<text x="83" y="14">440</text>
<text x="83" y="14">368</text>
</g>
</svg>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 654 B

After

Width:  |  Height:  |  Size: 654 B

bin/reporting/detection_coverage.svg
+1 -1
View File
@@ -13,6 +13,6 @@
<rect rx="3" width="100" height="20" fill="url(#a)"/>
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
<text x="30" y="14">coverage</text>
<text x="80" y="14">100%</text>
<text x="80" y="14">99%</text>
</g>
</svg>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 653 B

After

Width:  |  Height:  |  Size: 652 B

bin/validate.py
+11 -11
View File
@@ -160,23 +160,23 @@ def validate_standard_fields(object, uuids):
if 'product' not in object['tags']:
errors.append("ERROR: a `product` tag is required for object: %s" % object['name'])
# check risk score values
for k,v in object['tags'].items():
if k == 'impact':
if not isinstance(v, int):
errors.append("ERROR: impact not integer value for object: %s" % v)
if k == 'confidence':
if not isinstance(v, int):
errors.append("ERROR: confidence not integer value for object: %s" % v)
if k == 'risk_score':
if not isinstance(v, int):
errors.append("ERROR: risk_score not integer value for object: %s" % v)
risk_object_type = ["user","system", "other"]
if k == 'risk_object_type':
if v not in risk_object_type:
errors.append("ERROR: risk_object_type can only contain user, system, other: %s" % v)
if k == 'risk_object':
try:
v.encode('ascii')
except UnicodeEncodeError:
errors.append("ERROR: risk_object not ascii for object: %s" % v)
if 'impact' in object['tags'] and 'confidence' in object['tags']:
calculated_risk_score = int(((object['tags']['impact'])*(object['tags']['confidence']))/100)
if calculated_risk_score != object['tags']['risk_score']:
errors.append("ERROR: risk_score not calulated correctly and it should be set as: %s" % calculated_risk_score)
return errors, uuids
contentctl.py
+2 -2
View File
@@ -73,7 +73,7 @@ def generate(args):
print("ERROR: contentctl failed to find folder for deployment {0}".format(output))
sys.exit(1)
print("contentctl is generating a new splunk_app under ".format(output))
print("contentctl is generating a new splunk_app under {}".format(output))
generator.main(security_content_path, args.output, args.product, args.verbose)
@@ -112,7 +112,7 @@ def main(args):
generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu",
help="Path where to store the deployment package, defaults to `dist/escu`")
generate_parser.add_argument("--product", required=False, type=str, default="ESCU",
help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
generate_parser.set_defaults(func=generate)
# # parse them
detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+13 -3
View File
@@ -31,16 +31,28 @@ tags:
automated_detection_testing: passed
cis20:
- CIS 16
confidence: 50
context:
- Source:Cloud Data
- Stage:Recon
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
impact: 30
kill_chain_phases:
- Actions on Objectives
message: user $user$ has made $api_calls$ api calls, violating the dynamic threshold
of $expected_upper_threshold$ with the following command $command$.
mitre_attack_id:
- T1078.004
nist:
- DE.DP
- DE.CM
- PR.AC
observable:
- name: user
type: User
role:
- Attacker
product:
- Splunk Security Analytics for AWS
- Splunk Enterprise
@@ -51,7 +63,5 @@ tags:
- All_Changes.command
- All_Changes.user
- All_Changes.status
risk_object: user
risk_object_type: user
risk_score: 25
risk_score: 15
security_domain: network
detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-02-22'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user created a policy
description: This search looks for AWS CloudTrail events where a user created a policy
version that allows them to access any resource in their account
search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
@@ -16,7 +16,7 @@ search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.
awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a policy to allow a user to access all
resources. That said, AWS strongly advises against granting full control to all
detections/cloud/aws_createaccesskey.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A who has already
description: This search looks for AWS CloudTrail events where a user A who has already
permission to create access keys, makes an API call to create access keys for another
user B. Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.
eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created keys for another user.
references:
detections/cloud/aws_createloginprofile.yml
+4 -4
View File
@@ -5,9 +5,9 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A(victim A) creates
a login profile for user B, followed by a AWS Console login event from user B from
the same src_ip as user B. This correlated event can be indicative of privilege
description: This search looks for AWS CloudTrail events where a user A(victim A)
creates a login profile for user B, followed by a AWS Console login event from user
B from the same src_ip as user B. This correlated event can be indicative of privilege
escalation since both events happened from the same src_ip
search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName
as new_login_profile | table src_ip eventName new_login_profile userName | join
@@ -17,7 +17,7 @@ search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.
awsRegion userIdentity.principalId user_arn new_login_profile src_ip | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`] | `aws_createloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created a login profile for another user.
references:
detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+1 -1
View File
@@ -19,7 +19,7 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
search works with AWS CloudTrail logs
known_false_positives: unknown
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
+1 -1
View File
@@ -14,7 +14,7 @@ search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e
values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
search works with AWS CloudTrail logs
known_false_positives: bucket with S3 encryption
references:
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
detections/cloud/aws_excessive_security_scanning.yml
+4 -4
View File
@@ -5,16 +5,16 @@ date: '2021-04-13'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events and analyse the amount of eventNames
which starts with Describe by a single user. This indicates that this user scans
the configuration of your AWS cloud environment.
description: This search looks for AWS CloudTrail events and analyse the amount of
eventNames which starts with Describe by a single user. This indicates that this
user scans the configuration of your AWS cloud environment.
search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* |
stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
values(eventName) as eventName values(src) as src values(userAgent) as userAgent
by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives.
references:
- https://github.com/aquasecurity/cloudsploit
detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-01-11'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: batch
datamodel: []
description: The search looks for CloudTrail events to detect if any network ACLs
description: The search looks for AWS CloudTrail events to detect if any network ACLs
were created with all the ports open to a specified CIDR.
search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail
inputs.
known_false_positives: It's possible that an admin has created this ACL with all ports
open for some legitimate purpose however, this should be scoped and not allowed
detections/cloud/aws_network_access_control_list_deleted.yml
+2 -2
View File
@@ -9,13 +9,13 @@ description: Enforcing network-access controls is one of the defensive mechanism
used by cloud administrators to restrict access to a cloud instance. After the attacker
has gained control of the AWS console by compromising an admin account, they can
delete a network ACL and gain access to the instance from anywhere. This search
will query the CloudTrail logs to detect users deleting network ACLs.
will query the AWS CloudTrail logs to detect users deleting network ACLs.
search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
| fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs.
known_false_positives: It's possible that a user has legitimately deleted a network
ACL.
detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as f
userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_access_by_provider_user_and_principal_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs
search works with AWS CloudTrail logs
known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
are very difficult to detect as accessing cloud providers with these assertions
looks exactly like normal access, however things such as source IP sourceIPAddress
detections/cloud/aws_saml_update_identity_provider.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as f
userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|`aws_saml_update_identity_provider_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: Updating a SAML provider or creating a new one may not necessarily
be malicious however it needs to be closely monitored.
references:
detections/cloud/aws_setdefaultpolicyversion.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user has set a default
description: This search looks for AWS CloudTrail events where a user has set a default
policy versions. Attackers have been know to use this technique for Privilege Escalation
in case the previous versions of the policy had permissions to access more resources
than the current version of the policy
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazon
errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately set a default policy to allow a user to access
all resources. That said, AWS strongly advises against granting full control to
detections/cloud/aws_updateloginprofile.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2021-03-02'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user A who has already
description: This search looks for AWS CloudTrail events where a user A who has already
permission to update login profile, makes an API call to update login profile for
another user B . Attackers have been know to use this technique for Privilege Escalation
in case new victim(user B) has more permissions than old victim(user B)
@@ -15,7 +15,7 @@ search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazona
eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userName
user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
search works with cloudtrail logs.
search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
that an AWS admin has legitimately created keys for another user.
references:
detections/cloud/detect_aws_console_login_by_new_user.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Rico Valdez, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -21,8 +21,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+3 -3
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
type: batch
datamodel:
- Authentication
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -24,8 +24,8 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
in CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail
in AWS CloudTrail - Initial` support search only once to create a baseline of previously
seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
- Update` hourly (or more frequently depending on how often you run the detection
searches) to refresh the baselines. You can also provide additional filtering for
this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
detections/cloud/detect_new_open_s3_buckets.yml
+2 -2
View File
@@ -5,8 +5,8 @@ date: '2021-01-12'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user has created an open/public
S3 bucket.
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket.
search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
"(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
| search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI
detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+2 -2
View File
@@ -5,8 +5,8 @@ date: '2021-01-12'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user has created an open/public
S3 bucket over the aws cli.
description: This search looks for AWS CloudTrail events where a user has created
an open/public S3 bucket over the aws cli.
search: '`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp
detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml
+4 -4
View File
@@ -5,9 +5,9 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user successfully launches
an abnormally high number of instances. This search is deprecated and have been
translated to use the latest Change Datamodel
description: This search looks for AWS CloudTrail events where a user successfully
launches an abnormally high number of instances. This search is deprecated and have
been translated to use the latest Change Datamodel
search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m _time
| stats count AS instances_launched by _time userName | eventstats avg(instances_launched)
as total_launched_avg, stdev(instances_launched) as total_launched_stdev | eval
@@ -17,7 +17,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m
/ total_launched_stdev, 2) | table _time, userName, instances_launched, num_standard_deviations_away,
total_launched_avg, total_launched_stdev | `abnormally_high_aws_instances_launched_by_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. The threshold value should be tuned to your environment.
known_false_positives: Many service accounts configured within an AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml
+4 -4
View File
@@ -5,15 +5,15 @@ date: '2020-07-21'
author: Jason Brewer, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user successfully launches
an abnormally high number of instances. This search is deprecated and have been
translated to use the latest Change Datamodel.
description: This search looks for AWS CloudTrail events where a user successfully
launches an abnormally high number of instances. This search is deprecated and have
been translated to use the latest Change Datamodel.
search: '`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter`
| bucket span=10m _time | stats count as instances_launched by _time src_user |
apply ec2_excessive_runinstances_v1 | rename "IsOutlier(instances_launched)" as
isOutlier | where isOutlier=1'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. The threshold value should be tuned to your environment.
known_false_positives: Many service accounts configured within an AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml
+4 -4
View File
@@ -5,9 +5,9 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where an abnormally high number
of instances were successfully terminated by a user in a 10-minute window. This
search is deprecated and have been translated to use the latest Change Datamodel.
description: This search looks for AWS CloudTrail events where an abnormally high
number of instances were successfully terminated by a user in a 10-minute window.
This search is deprecated and have been translated to use the latest Change Datamodel.
search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket span=10m
_time | stats count AS instances_terminated by _time userName | eventstats avg(instances_terminated)
as total_terminations_avg, stdev(instances_terminated) as total_terminations_stdev
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=TerminateInstances errorCode=success | bucket sp
num_standard_deviations_away, total_terminations_avg, total_terminations_stdev |
`abnormally_high_aws_instances_terminated_by_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs.
known_false_positives: Many service accounts configured with your AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml
+4 -4
View File
@@ -5,15 +5,15 @@ date: '2020-07-21'
author: Jason Brewer, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user successfully terminates
an abnormally high number of instances. This search is deprecated and have been
translated to use the latest Change Datamodel.
description: This search looks for AWS CloudTrail events where a user successfully
terminates an abnormally high number of instances. This search is deprecated and
have been translated to use the latest Change Datamodel.
search: '`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter`
| bucket span=10m _time | stats count as instances_terminated by _time src_user |
apply ec2_excessive_terminateinstances_v1 | rename "IsOutlier(instances_terminated)"
as isOutlier | where isOutlier=1'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. The threshold value should be tuned to your environment.
known_false_positives: Many service accounts configured within an AWS infrastructure
are known to exhibit this behavior. Please adjust the threshold values and filter
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
src_ip, City, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_city_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml
+1 -1
View File
@@ -21,7 +21,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time,
user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail`
| spath output=user userIdentity.arn | rename sourceIPAddress as src_ip | table
_time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
output=user userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user,
src_ip, Region, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_region_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen AWS Provisioning
Activity Sources" support search once to create a history of previously seen locations
that have provisioned AWS resources.
detections/deprecated/detect_api_activity_from_users_without_mfa.yml
+3 -3
View File
@@ -5,8 +5,8 @@ date: '2018-05-17'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user logged into the
AWS account, is making API calls and has not enabled Multi Factor authentication.
description: This search looks for AWS CloudTrail events where a user logged into
the AWS account, is making API calls and has not enabled Multi Factor authentication.
Multi factor authentication adds a layer of security by forcing the users to type
a unique authentication code from an approved authentication device when they access
AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged
@@ -17,7 +17,7 @@ search: '`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=fa
as eventName by userIdentity.arn userIdentity.type user | `security_content_ctime(firstTime)` |
`security_content_ctime(lastTime)` | `detect_api_activity_from_users_without_mfa_filter`'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. Leverage the support search `Create a list of approved AWS service accounts`:
run it once every 30 days to create a list of service accounts and validate them.\
detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for successful CloudTrail activity by user accounts
description: This search looks for successful AWS CloudTrail activity by user accounts
that are not listed in the identity table or `aws_service_accounts.csv`. It returns
event names and count, as well as the first and last time a specific user or service
is detected, grouped by users. Deprecated because managing this list can be quite
@@ -17,7 +17,7 @@ search: '`cloudtrail` errorCode=success | rename userName as identity | search N
user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_aws_api_activities_from_unapproved_accounts_filter`'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You must also populate the `identity_lookup_expanded` lookup shipped with
the Asset and Identity framework to be able to look up users in your identity table
in Enterprise Security (ES). Leverage the support search called "Create a list of
detections/deprecated/detect_new_api_calls_from_user_roles.yml
+2 -2
View File
@@ -18,9 +18,9 @@ search: '`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=A
as earliest latest(_time) as latest by user | `security_content_ctime(earliest)`
| `security_content_ctime(latest)` | `detect_new_api_calls_from_user_roles_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously seen API call per user
roles in CloudTrail" support search once to create a history of previously seen
roles in AWS CloudTrail" support search once to create a history of previously seen
user roles.
known_false_positives: It is possible that there are legitimate user roles making
new or infrequently used API calls in your infrastructure, causing the search to
detections/deprecated/detect_new_user_aws_console_login.yml
+6 -6
View File
@@ -5,7 +5,7 @@ date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events wherein a console login event
description: This search looks for AWS CloudTrail events wherein a console login event
by a user was recorded within the last hour, then compares the event to a lookup
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
@@ -17,11 +17,11 @@ search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user |
"-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Run the "Previously seen users in CloudTrail" support search only once to
create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in CloudTrail" hourly (or more frequently depending on how
often you run the detection searches) to refresh the baselines.
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. Run the "Previously seen users in AWS CloudTrail" support search only once
to create a baseline of previously seen IAM users within the last 30 days. Run "Update
previously seen users in AWS CloudTrail" hourly (or more frequently depending on
how often you run the detection searches) to refresh the baselines.
known_false_positives: When a legitimate new user logins for the first time, this
activity will be detected. Check how old the account is and verify that the user
activity is legitimate.
detections/deprecated/detect_spike_in_aws_api_activity.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: '`cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApi
as eventName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user
| `detect_spike_in_aws_api_activity_filter`'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
your environment. The `dataPointThreshold` variable is the minimum number of data
points required to have a statistically significant amount of data to determine.
detections/deprecated/detect_spike_in_network_acl_activity.yml
+1 -1
View File
@@ -23,7 +23,7 @@ search: '`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_eve
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
your environment. The `dataPointThreshold` variable is the minimum number of data
points required to have a statistically significant amount of data to determine.
detections/deprecated/detect_spike_in_security_group_activity.yml
+1 -1
View File
@@ -24,7 +24,7 @@ search: '`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
as uniqueApisCalled by user | `detect_spike_in_security_group_activity_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
your environment. The `dataPointThreshold` variable is the minimum number of data
points required to have a statistically significant amount of data to determine.
detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml
+1 -1
View File
@@ -17,7 +17,7 @@ search: '`cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_mod
| rename arn as userIdentity.arn | table userIdentity.arn] | spath output=dest responseElements.instancesSet.items{}.instanceId
| spath output=user userIdentity.arn | table _time, user, dest | `ec2_instance_modified_with_previously_unseen_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Launches By
User" support search once to create a history of previously seen ARNs. To add or
remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml
+2 -2
View File
@@ -5,7 +5,7 @@ date: '2018-02-23'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where an instance is started
description: This search looks for AWS CloudTrail events where an instance is started
in a particular region in the last one hour and then compares it to a lookup file
of previously seen regions where an instance was started
search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as earliest
@@ -16,7 +16,7 @@ search: '`cloudtrail` earliest=-1h StartInstances | stats earliest(_time) as ear
| `security_content_ctime(latest)` | where regionStatus="Instance Started in a New
Region" | `ec2_instance_started_in_previously_unseen_region_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. Run the "Previously seen AWS Regions" support search only once to create
of baseline of previously seen regions. This search is deprecated and have been
translated to use the latest Change Datamodel.
detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
as arn, requestParameters.instancesSet.items{}.imageId as amiID | table firstTime,
lastTime, arn, amiID, dest, instanceType | `ec2_instance_started_with_previously_unseen_ami_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 AMIs" support
search once to create a history of previously seen AMIs.
known_false_positives: After a new AMI is created, the first systems created with
detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml
+1 -1
View File
@@ -20,7 +20,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
as instanceType, responseElements.instancesSet.items{}.instanceId as dest | table
_time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_instance_type_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Instance Types"
support search once to create a history of previously seen instance types.
known_false_positives: It is possible that an admin will create a new system using
detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml
+1 -1
View File
@@ -18,7 +18,7 @@ search: '`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunI
as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn
as user | table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
inputs. This search works best when you run the "Previously Seen EC2 Launches By
User" support search once to create a history of previously seen ARNs.
known_false_positives: It's possible that a user will start to create EC2 instances
detections/deprecated/remote_wmi_command_attempt.yml
-47
View File
@@ -1,47 +0,0 @@
name: Remote WMI Command Attempt
id: 272df6de-61f1-4784-877c-1fbc3e2d0838
version: 2
date: '2018-12-03'
author: Rico Valdez, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for wmic.exe being launched with parameters to operate
on remote systems.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe AND
Processes.process= */node* by Processes.user Processes.process_name Processes.parent_process_name
Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model. Deprecated because duplicate of Remote Process Instantiation via WMI.
known_false_positives: Administrators may use this legitimately to gather info from
remote systems.
references: []
tags:
analytic_story:
- Suspicious WMI Use
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1047
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
security_domain: endpoint
detections/deprecated/ssa___rare_parent_process_relationship_lolbas.yml
-82
View File
@@ -1,82 +0,0 @@
name: Rare Parent-Child Process Relationship
id: e03aa905-6549-4e34-b304-7a922185b2c4
version: 1
date: '2020-08-13'
author: Ignacio Bermudez Corrales, Splunk
type: streaming
datamodel: []
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This search leverages the Splunk Streaming
ML DSP plugin to find rare parent/child relationships. The list of application has
been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) | where
parent_process_name!=null | select parent_process_name, process_name, timestamp,
dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
target="process_name" | rename output as input | where input < 1 | adaptive_threshold
algorithm="quantile" entity="parent_process_name" window=604800000L | where label
AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe"
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body = "TBD" | into write_null();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some custom tools used by admins could be used rarely to launch
remotely applications. This might trigger false positives at the beginning when
it hasn''t collected yet enough data to construct the baseline.
'
references: []
tags:
analytic_story:
- Unusual Processes
cis20:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1203
- T1059
- T1053
- T1072
nist:
- PR.PT
- DE.CM
product:
- Splunk Behavioral Analytics
required_fields:
- process_name
- parent_process_name
- _time
- dest_device_id
- dest_user_id
risk_severity: low
security_domain: endpoint
detections/endpoint/access_lsass_memory_for_dump_creation.yml
+19
View File
@@ -28,14 +28,32 @@ tags:
cis20:
- CIS 6
- CIS 8
confidence: 90
context:
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
impact: 70
kill_chain_phases:
- Actions on Objectives
message: process $SourceImage$ injected into $TargetImage$ and was attempted dump
LSASS on $dest$. Adversaries tend to do this when trying to accesss credential
material stored in the process memory of the Local Security Authority Subsystem
Service (LSASS).
mitre_attack_id:
- T1003.001
nist:
- DE.CM
observable:
- name: dest
type: Endpoint
role:
- Victim
- name: TargetImage
type: Process
role:
- Target
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -49,4 +67,5 @@ tags:
- TargetProcessId
- SourceImage
- SourceProcessId
risk_score: 63
security_domain: endpoint
detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+52
View File
@@ -0,0 +1,52 @@
name: Allow File And Printing Sharing In Firewall
id: ce27646e-d411-11eb-8a00-acde48001122
version: 1
date: '2021-06-23'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a suspicious modification of firewall to allow
file and printer sharing. This technique was seen in ransomware to be able to discover
more machine connected to the compromised host to encrypt more files
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `allow_file_and_printing_sharing_in_firewall_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
references:
- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1562.007
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
- Processes.parent_process_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/allow_network_discovery_in_firewall.yml
+54
View File
@@ -0,0 +1,54 @@
name: Allow Network Discovery In Firewall
id: ccd6a38c-d40b-11eb-85a5-acde48001122
version: 1
date: '2021-06-23'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a suspicious modification to the firewall to
allow network discovery on a machine. This technique was seen in couple of ransomware
(revil, reddot) to discover other machine connected to the compromised host to encrypt
more files.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" Processes.process="*Yes*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `allow_network_discovery_in_firewall_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: network admin may modify this firewall feature that may cause
this rule to be triggered.
references:
- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
- Revil Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1562.007
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
- Processes.parent_process_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/allow_operation_with_consent_admin.yml
+3 -3
View File
@@ -30,6 +30,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Registry.registry_value_name
- Registry.dest
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+3 -3
View File
@@ -25,6 +25,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -44,6 +47,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/delete_shadowcopy_with_powershell.yml
+1 -1
View File
@@ -11,7 +11,7 @@ description: This following analytic detects PowerShell command to delete shadow
to deploy DarkSide Ransomware where it executed a child process of PowerShell to
execute a hex encoded command to delete shadow copy. This hex encoded command was
able to be decrypted by PowerShell log.
search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*"
search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `delete_shadowcopy_with_powershell_filter`'
detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+59
View File
@@ -0,0 +1,59 @@
name: Detect Empire with PowerShell Script Block Logging
id: bc1dc6b8-c954-11eb-bade-acde48001122
version: 1
date: '2021-06-09'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies the common PowerShell stager used by PowerShell-Empire.
Each stager that may use PowerShell all uses the same pattern. The initial HTTP
will be base64 encoded and use `system.net.webclient`. Note that some obfuscation
may evade the analytic. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 (Message=*system.net.webclient* AND Message=*frombase64string*)
| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_empire_with_powershell_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives may only pertain to it not being related to
Empire, but another framework. Filter as needed if any applications use the same
pattern.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://github.com/BC-SECURITY/Empire
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+56
View File
@@ -0,0 +1,56 @@
name: Detect Mimikatz With PowerShell Script Block Logging
id: 8148c29c-c952-11eb-9255-acde48001122
version: 1
date: '2021-06-09'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies common Mimikatz functions that may be identified in the
script block, including `mimikatz`. This will catch the most basic use cases for
Pass the Ticket, Pass the Hash and `-DumprCreds`. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
*kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time)
as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives should be limited as the commands being identifies
are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/detect_wmi_event_subscription_persistence.yml
+62
View File
@@ -0,0 +1,62 @@
name: Detect WMI Event Subscription Persistence
id: 01d9a0c2-cece-11eb-ab46-acde48001122
version: 1
date: '2021-06-16'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic identifies the use of WMI Event Subscription
to establish persistence or perform privilege escalation. WMI can be used to install
event filters, providers, consumers, and bindings that execute code when a defined
event occurs. WMI subscription execution is proxied by the WMI Provider Host process
(WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic
is restricted by commonly added process execution and a path. If the volume is low
enough, remove the values and flag on any new subscriptions.
All event subscriptions have three components \
1. Filter - WQL Query for the events we want. EventID = 19 \
1. Consumer - An action to take upon triggering the filter. EventID = 20 \
1. Binding - Registers a filter to a consumer. EventID = 21 \
Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding.
It may be pertinent to review all 3 to identify the flow of execution. In addition,
EventCode 4104 may assist with any other PowerShell script usage that registered
the subscription.'
search: '`sysmon` EventID=20 | stats count min(_time) as firstTime max(_time) as lastTime
by Computer User Destination | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_wmi_event_subscription_persistence_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with that provide WMI Event Subscription from your endpoints. If you are using
Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID
19, 20 and 21. Tune and filter known good to limit the volume.
known_false_positives: It is possible some applications will create a consumer and
may be required to be filtered. For tuning, add any additional LOLBin's for further
depth of coverage.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md
- https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
- https://github.com/trustedsec/SysmonCommunityGuide/blob/master/WMI-events.md
- https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
tags:
analytic_story:
- Suspicious WMI Use
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1546.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Destination
- Computer
- User
security_domain: endpoint
detections/endpoint/disable_amsi_through_registry.yml
+49
View File
@@ -0,0 +1,49 @@
name: Disable AMSI Through Registry
id: 9c27ec42-d338-11eb-9044-acde48001122
version: 1
date: '2021-06-22'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to identify modification in registry to disable AMSI windows
feature to evade detections. This technique was seen in several ransomware, RAT
and even APT to impaire defenses of the compromise machine and to be able to execute
payload with minimal alert as much as possible.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)"
by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: network operator may disable this feature of windows but not
so common.
references:
- https://blog.f-secure.com/hunting-for-amsi-bypasses/
- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9
tags:
analytic_story:
- Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Registry.dest
- Registry.registry_value_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/disable_etw_through_registry.yml
+47
View File
@@ -0,0 +1,47 @@
name: Disable ETW Through Registry
id: f0eacfa4-d33f-11eb-8f9d-acde48001122
version: 1
date: '2021-06-22'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to identify modification in registry to disable ETW windows
feature to evade detections. This technique was seen in several ransomware, RAT
and even APT to impaire defenses of the compromise machine and to be able to execute
payload with minimal alert as much as possible.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: network operator may disable this feature of windows but not
so common.
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Registry.dest
- Registry.registry_value_name
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/disable_logs_using_wevtutil.yml
+3 -3
View File
@@ -26,6 +26,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/disable_windows_behavior_monitoring.yml
+11 -5
View File
@@ -10,11 +10,15 @@ description: This search is to identifies a modification in registry to disable
windows denfender real time behavior monitoring. This event or technique is commonly
seen in RAT, bot, or Trojan to disable AV to evade detections.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path=
"*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)"
as lastTime from datamodel=Endpoint.Registry where
Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR
Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR
Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR
Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR
Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR
Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR
Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning"
Registry.registry_value_name = "DWORD (0x00000001)"
by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`'
@@ -28,6 +32,8 @@ references:
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Ransomware
- Revil Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
+1 -1
View File
@@ -28,6 +28,7 @@ references:
tags:
analytic_story:
- meterpreter
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log
kill_chain_phases:
@@ -44,4 +45,3 @@ tags:
- Processes.dest
- Processes.user
security_domain: endpoint
automated_detection_testing: passed
detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
+57
View File
@@ -0,0 +1,57 @@
name: Excessive number of service control start as disabled
id: 77592bec-d5cc-11eb-9e60-acde48001122
version: 1
date: '2021-06-25'
author: Michael Hart, Splunk
type: batch
datamodel:
- Endpoint
description: This detection targets behaviors observed when threat actors have used
sc.exe to modify services. We observed malware in a honey pot spawning numerous
sc.exe processes in a short period of time, presumably to impair defenses, possibly
to block others from compromising the same machine. This detection will alert when
we see both an excessive number of sc.exe processes launched with specific commandline
arguments to disable the start of certain services.
search: '| tstats `security_content_summariesonly` distinct_count(Processes.process)
as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name
= "sc.exe" AND Processes.process="*start= disabled*" by Processes.dest Processes.user
Processes.parent_process Processes.process_name Processes.parent_process_id, _time
span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must be ingesting
logs with both the process name and command line from your endpoints. The complete
process name with command-line arguments are mapped to the "process" field in the
Endpoint data model.
known_false_positives: Legitimate programs and administrators will execute sc.exe
with the start disabled flag. It is possible, but unlikely from the telemetry of
normal Windows operation we observed, that sc.exe will be called more than seven
times in a short period of time.
references:
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
- https://attack.mitre.org/techniques/T1562/001/
tags:
analytic_story:
- Windows Defense Evasion Tactics
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
detections/endpoint/excessive_service_stop_attempt.yml
+2 -1
View File
@@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "net.exe"
OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND
Processes.process="*stop*" OR Processes.process="*/delete*" by Processes.process_name
Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name
Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`'
@@ -28,6 +28,7 @@ references:
tags:
analytic_story:
- XMRig
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
detections/endpoint/excessive_usage_of_net_app.yml
+1
View File
@@ -26,6 +26,7 @@ references:
tags:
analytic_story:
- XMRig
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
detections/endpoint/excessive_usage_of_nslookup_app.yml
+3 -6
View File
@@ -46,10 +46,7 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Computer
- process_name
- EventCode
security_domain: endpoint
detections/endpoint/excessive_usage_of_sc_service_utility.yml
+46
View File
@@ -0,0 +1,46 @@
name: Excessive Usage Of SC Service Utility
id: cb6b339e-d4c6-11eb-a026-acde48001122
version: 1
date: '2021-06-24'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a suspicious excessive usage of sc.exe in a
host machine. This technique was seen in several ransomware , xmrig and other malware
to create, modify, delete or disable a service may related to security application
or to gain privilege escalation.
search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m |
stats values(process) as process count as numScExe by Computer, _time | eventstats
avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer
| eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe >
5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
known_false_positives: excessive execution of sc.exe is quite suspicious since it
can modify or execute app in high privilege permission.
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1569.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- process_name
- process
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
+48
View File
@@ -0,0 +1,48 @@
name: Execute Javascript With Jscript COM CLSID
id: dc64d064-d346-11eb-8588-acde48001122
version: 1
date: '2021-06-22'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This analytic will identify suspicious process of cscript.exe where it
tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique
was seen in ransomware (reddot ransomware) where it execute javascript with this
com object with combination of amsi disabling technique.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe"
Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name
Processes.process_name Processes.process Processes.parent_process Processes.process_id
Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: unknown
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1059.005
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.parent_process
- Processes.process_id
- Processes.dest
- Processes.user
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/icacls_grant_command.yml
+1
View File
@@ -27,6 +27,7 @@ references:
tags:
analytic_story:
- XMRig
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
detections/endpoint/malicious_powershell_executed_as_a_service.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: This detection is to identify the abuse the Windows SC.exe to execu
malicious commands or payloads via PowerShell.
search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
| regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
| regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*"
| regex l_Service_File_Name="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`'
detections/endpoint/msmpeng_application_dll_side_loading.yml
+48
View File
@@ -0,0 +1,48 @@
name: Msmpeng Application DLL Side Loading
id: 8bb3f280-dd9b-11eb-84d5-acde48001122
version: 1
date: '2021-07-05'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll
in non default windows defender folder. This technique was seen couple days ago
with revil ransomware in Kaseya Supply chain. The approach is to drop an old version
of msmpeng.exe to load the actual payload name as mspvc.dll which will load the
revil ransomware to the compromise machine
search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND
Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time
Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
known_false_positives: quite minimal false positive expected.
references:
- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
tags:
analytic_story:
- Ransomware
- Revil Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1574.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Filesystem.file_create_time
- Filesystem.process_id
- Filesystem.file_name
- Filesystem.user
- Filesystem.file_path
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log
detections/endpoint/office_document_spawned_child_process_to_download.yml
+6 -6
View File
@@ -1,7 +1,7 @@
name: Office Document Spawned Child Process To Download
id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
version: 1
date: '2021-04-16'
version: 2
date: '2021-06-23'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
@@ -12,10 +12,10 @@ description: this search is to detect potential malicious office document execut
blend it to the normal noise in the infected machine to cover its track.
search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
"excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName
IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) | stats min(_time)
as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process
cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
detections/endpoint/permission_modification_using_takeown_app.yml
+3 -3
View File
@@ -26,6 +26,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -45,6 +48,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/powershell_creating_thread_mutex.yml
+17 -12
View File
@@ -4,25 +4,33 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect suspicious powershell script that using mutex
function. This function is commonly seen in some obfuscated powershell script to
make sure that only one instance of there process is running to a compromise machine
which is also a good indicator to check why powershell script is using it.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 that is using the `mutex` function. This function is commonly
seen in some obfuscated PowerShell scripts to make sure that only one instance of
there process is running on a compromise machine. During triage, review parallel
processes within the same timeframe. Review the full script block to identify other
related artifacts.
search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell developer may used this function in their script
for instance checking too.
references:
- https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -38,6 +46,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/powershell_disable_security_monitoring.yml
+50
View File
@@ -0,0 +1,50 @@
name: Powershell Disable Security Monitoring
id: c148a894-dd93-11eb-bf2a-acde48001122
version: 1
date: '2021-07-05'
author: Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to identifies a modification in registry to disable the
windows denfender real time behavior monitoring. This event or technique is commonly
seen in RAT, bot, or Trojan to disable AV to evade detections.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe",
"pwsh.exe", "sqlps.exe", "sqltoolsps.exe") Processes.process="*set-mppreference*"
AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*")
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives. However, tune based on scripts that
may perform this action.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
tags:
analytic_story:
- Ransomware
- Revil Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1562.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log
detections/endpoint/powershell_domain_enumeration.yml
+54
View File
@@ -0,0 +1,54 @@
name: PowerShell Domain Enumeration
id: e1866ce2-ca22-11eb-8e44-acde48001122
version: 1
date: '2021-06-10'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies specific PowerShell modules typically used to enumerate
an organizations domain or users. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*,
*get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: It is possible there will be false positives, filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_enable_smb1protocol_feature.yml
+44
View File
@@ -0,0 +1,44 @@
name: Powershell Enable SMB1Protocol Feature
id: afed80b2-d34b-11eb-a952-acde48001122
version: 1
date: '2021-06-22'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a suspicious enabling of smb1protocol through
"powershell.exe". This technique was seen in some ransomware (like reddot) where
it enable smb share to do the lateral movement and encrypt other files within the
compromise network system.
search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message
= "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_enable_smb1protocol_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
known_false_positives: network operator may enable or disable this windows feature.
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Malicious PowerShell
- Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1027.005
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+58
View File
@@ -0,0 +1,58 @@
name: Powershell Fileless Process Injection via GetProcAddress
id: a26d9db4-c883-11eb-9d75-acde48001122
version: 1
date: '2021-06-08'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies `GetProcAddress` in the script block. This is not normal
to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack
toolkits use GetProcAddress to obtain code execution. \
In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later
referenced/executed elsewhere. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message=*getprocaddress* | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Limited false positives. Filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1055
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+58
View File
@@ -0,0 +1,58 @@
name: Powershell Fileless Script Contains Base64 Encoded Content
id: 8acbc04c-c882-11eb-b060-acde48001122
version: 1
date: '2021-06-08'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies `FromBase64String` within the script block. A typical malicious
instance will include additional code. \
Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....`
\
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives should be limited. Filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
- Privilege Escalation
mitre_attack_id:
- T1027
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
+57
View File
@@ -0,0 +1,57 @@
name: PowerShell Loading DotNET into Memory via System Reflection Assembly
id: 85bc3f30-ca28-11eb-bd21-acde48001122
version: 1
date: '2021-06-10'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify suspicious PowerShell execution. Script Block Logging captures the command
sent to PowerShell, the full command to be executed. Upon enabling, logs will output
to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
\
This analytic identifies the use of PowerShell loading .net assembly via reflection.
This is commonly found in malicious PowerShell usage, including Empire and Cobalt
Strike. In addition, the `load(` value may be modifed by removing `(` and it will
identify more events to review. \
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*"
| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives will be limited to
references:
- https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1059.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
security_domain: endpoint
detections/endpoint/powershell_processing_stream_of_data.yml
+17 -12
View File
@@ -4,25 +4,33 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to detect suspicious powershell that processing compressed
stream data. This technique was seen in obfuscated powershell or powershell with
embedded .net or binary files that are stream flated and will be deflated during
execution.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 that is processing compressed stream data. This is typically
found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files
that are stream flattened and will be deflated durnig execution. During triage,
review parallel processes within the same timeframe. Review the full script block
to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell may used this function to process compressed data.
references:
- https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -39,6 +47,3 @@ tags:
- User
- Score
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/powershell_using_memory_as_backing_store.yml
+16 -12
View File
@@ -4,26 +4,33 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to detect suspicious powershell script that using memory
stream as new object backstore. This technique is commonly seen in malicious powershell
contain a stream flate data and will be decompressed in memory to run or drop the
actual payload to the compromise machine.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 that is using memory stream as new object backstore. The malicious
PowerShell script will contain stream flate data and will be decompressed in memory
to run or drop the actual payload. During triage, review parallel processes within
the same timeframe. Review the full script block to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats
count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_using_memory_as_backing_store_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
registry to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: powershell may used this function to store out object into
memory.
references:
- https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -39,6 +46,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
+3 -3
View File
@@ -27,6 +27,9 @@ references:
tags:
analytic_story:
- Ransomware
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -46,6 +49,3 @@ tags:
- Processes.process_id
- Processes.process_guid
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
detections/endpoint/print_spooler_adding_a_printer_driver.yml
+69
View File
@@ -0,0 +1,69 @@
name: Print Spooler Adding A Printer Driver
id: 313681a2-da8e-11eb-adad-acde48001122
version: 1
date: '2021-07-01'
author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: 'The following analytic identifies new printer drivers being load by
utilizing the Windows PrintService operational logs, EventCode 316. This was identified
during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare.
\
Within the proof of concept code, the following event will occur - "Printer driver
1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll,
evil.dll. No user action is required." \
During triage, isolate the endpoint and review for source of exploitation. Capture
any additional file modification events and review the source of where the exploitation
began.'
search: '`printservice` EventCode=316 category = "Adding a printer driver" Message
= "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats count
min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName
Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `print_spooler_adding_a_printer_driver_filter`'
how_to_implement: You will need to ensure PrintService Admin and Operational logs
are being logged to Splunk from critical or all systems.
known_false_positives: Unknown. This may require filtering.
references:
- https://twitter.com/MalwareJake/status/1410421445608476679?s=20
- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
tags:
analytic_story:
- PrintNightmare CVE-2021-34527
automated_detection_testing: passed
confidence: 90
context:
- Source:Endpoint
- Stage:Persistence,
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Incoming
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log
impact: 80
kill_chain_phases:
- Exploitation
message: Suspicious print driver was loaded on endpoint $ComputerName$.
mitre_attack_id:
- T1547.012
observable:
- name: ComputerName
type: Endpoint
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- OpCode
- EventCode
- ComputerName
- Message
risk_score: 72
security_domain: endpoint
detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
+67
View File
@@ -0,0 +1,67 @@
name: Print Spooler Failed to Load a Plug-in
id: 1adc9548-da7c-11eb-8f13-acde48001122
version: 1
date: '2021-07-01'
author: Mauricio Velazco, Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: 'The following analytic identifies driver load errors utilizing the Windows
PrintService Admin logs. This was identified during our testing of CVE-2021-34527
previously (CVE-2021-1675) or PrintNightmare. \
Within the proof of concept code, the following error will occur - "The print spooler
failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll,
error code 0x45A. See the event user data for context information." \
The analytic is based on file path and failure to load the plug-in. \
During triage, isolate the endpoint and review for source of exploitation. Capture
any additional file modification events.'
search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909"))
OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\"))
| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode
ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `print_spooler_failed_to_load_a_plug_in_filter`'
how_to_implement: You will need to ensure PrintService Admin and Operational logs
are being logged to Splunk from critical or all systems.
known_false_positives: False positives are unknown and filtering may be required.
references:
- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
tags:
analytic_story:
- PrintNightmare CVE-2021-34527
confidence: 90
context:
- Source:Endpoint
- Stage:Persistence,
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Incoming
dataset: []
impact: 80
kill_chain_phases:
- Exploitation
message: Suspicious printer spooler errors have occured on endpoint $ComputerName$
with EventCode $EventCode$.
mitre_attack_id:
- T1547.012
observable:
- name: ComputerName
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- OpCode
- EventCode
- ComputerName
- Message
risk_score: 72
security_domain: endpoint
detections/endpoint/process_execution_via_wmi.yml
+14 -9
View File
@@ -1,16 +1,21 @@
name: Process Execution via WMI
id: 24869767-8579-485d-9a4f-d9ddfd8f0cac
version: 3
version: 4
date: '2020-03-16'
author: Rico Valdez, Splunk
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel: []
description: This search looks for processes launched via WMI.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest
Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)`| `process_execution_via_wmi_filter` '
datamodel:
- Endpoint
description: The following analytic identifies `WmiPrvSE.exe` spawning a process.
This typically occurs when a process is instantiated from a local or remote process
using `wmic.exe`. During triage, review parallel processes for suspicious behavior
or commands executed. Review the process and command-line spawning from `wmiprvse.exe`.
Contain and remediate the endpoint as necessary.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter` '
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"
detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+17 -11
View File
@@ -4,25 +4,34 @@ version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a powershell script that do a recon or checking
to the av product install on the machine. This technique is commonly seen in APT
or malware like ransomware to list all security product and disable it.
datamodel: []
description: The following analytic identifies suspicious PowerShell script execution
via EventCode 4104 performing checks to identify anti-virus products installed on
the endpoint. This technique is commonly found in malware and APT events where the
adversary will map all running security applications or services. During triage,
review parallel processes within the same timeframe. Review the full script block
to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed registry
to monitor this event.
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: network administrator may used this command for checking purposes
references:
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Ransomware
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
@@ -38,6 +47,3 @@ tags:
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/recon_using__wmi_class.yml
-44
View File
@@ -1,44 +0,0 @@
name: Recon Using WMI Class
id: 018c1972-ca07-11eb-9473-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a powershell script that do a recon to the targetted
or compromised machine. This technique is common nowadays to know the running process,
services
search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recon_using__wmi_class_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed registry
to monitor this event.
known_false_positives: network administrator may used this command for checking purposes
references:
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
tags:
analytic_story:
- Malicious PowerShell
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1592
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
detections/endpoint/recon_using_wmi_class.yml
+50
View File
@@ -0,0 +1,50 @@
name: Recon Using WMI Class
id: 018c1972-ca07-11eb-9473-acde48001122
version: 1
date: '2021-06-10'
author: Teoderick Contreras, Splunk
type: batch
datamodel: []
description: The following analytic identifies suspicious PowerShell via EventCode
4104, where WMI is performing an event query looking for running processes or running
services. This technique is commonly found where the adversary will identify services
and system information on the compromised machine. During triage, review parallel
processes within the same timeframe. Review the full script block to identify other
related artifacts.
search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: network administrator may used this command for checking purposes
references:
- https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Malicious PowerShell
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1592
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
security_domain: endpoint
detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+50
View File
@@ -0,0 +1,50 @@
name: Recursive Delete of Directory In Batch CMD
id: ba570b3a-d356-11eb-8358-acde48001122
version: 1
date: '2021-06-22'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect a suspicious commandline designed to delete
files or directory recursive using batch command. This technique was seen in ransomware
(reddot) where it it tries to delete the files in recycle bin to impaire user from
recovering deleted files.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
Processes.process=*/c* Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*"
by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process
Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: network operator may use this batch command to delete recursively
a directory or files within directory
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
tags:
analytic_story:
- Ransomware
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1070.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.parent_process
- Processes.process_id
- Processes.dest
- Processes.user
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log
detections/endpoint/remote_wmi_command_attempt.yml
+61
View File
@@ -0,0 +1,61 @@
name: Remote WMI Command Attempt
id: 272df6de-61f1-4784-877c-1fbc3e2d0838
version: 3
date: '2018-12-03'
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: The following analytic identifies usage of `wmic.exe` spawning a local
or remote process, identified by the `node` switch. During triage, review parallel
processes for additional commands executed. Look for any file modifications before
and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm
execution or file modifications. Contain and isolate the endpoint as needed.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
Processes.process=*node* by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `remote_wmi_command_attempt_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model. Deprecated because duplicate of Remote Process Instantiation via WMI.
known_false_positives: Administrators may use this legitimately to gather info from
remote systems. Filter as needed.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
tags:
analytic_story:
- Suspicious WMI Use
asset_type: Endpoint
automated_detection_testing: passed
cis20:
- CIS 3
- CIS 5
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1047
nist:
- PR.PT
- PR.AT
- PR.AC
- PR.IP
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.process_name
- Processes.parent_process_name
- Processes.dest
- Processes.parent_process
- Processes.parent_process_id
- Processes.process_id
security_domain: endpoint
detections/endpoint/revil_registry_entry.yml
+1 -1
View File
@@ -13,7 +13,7 @@ description: This analytic identifies suspicious modification in registry entry
notes file name in the compromised host.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*")
AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary
Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`'
detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+1
View File
@@ -36,6 +36,7 @@ tags:
analytic_story:
- Suspicious Rundll32 Activity
- Cobalt Strike
- PrintNightmare CVE-2021-34527
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
detections/endpoint/script_execution_via_wmi.yml
+12 -10
View File
@@ -1,23 +1,25 @@
name: Script Execution via WMI
id: aa73f80d-d728-4077-b226-81ea0c8be589
version: 3
version: 4
date: '2020-03-16'
author: Rico Valdez, Splunk
author: Rico Valdez, Michael Haag, Splunk
type: batch
datamodel: []
datamodel:
- Endpoint
description: This search looks for scripts launched via WMI.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest Processes.process_name |
`drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
`script_execution_via_wmi_filter` '
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter` '
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"
field in the Endpoint data model.
known_false_positives: Although unlikely, administrators may use wmi to launch scripts
for legitimate purposes.
references: []
for legitimate purposes. Filter as needed.
references:
- https://redcanary.com/blog/child-processes/
tags:
analytic_story:
- Suspicious WMI Use
detections/endpoint/spoolsv_spawning_rundll32.yml
+77
View File
@@ -0,0 +1,77 @@
name: Spoolsv Spawning Rundll32
id: 15d905f6-da6b-11eb-ab82-acde48001122
version: 1
date: '2021-07-01'
author: Mauricio Velazco, Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: The following analytic identifies a suspicious child process, `rundll32.exe`,
with no command-line arguments being spawned from `spoolsv.exe`. This was identified
during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare.
Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During
triage, isolate the endpoint and review for source of exploitation. Capture any
additional file modification events.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe
Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `spoolsv_spawning_rundll32_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Limited false positives have been identified. There are limited
instances where `rundll32.exe` may be spawned by a legitimate print driver.
references:
- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
tags:
analytic_story:
- PrintNightmare CVE-2021-34527
automated_detection_testing: passed
confidence: 90
context:
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Local
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$.
This behavior is suspicious and related to PrintNightmare.
mitre_attack_id:
- T1547.012
observable:
- name: dest
type: Endpoint
role:
- Victim
- name: parent_process_id
type: Process
role:
- Parent Process
- Attacker
- name: process_id
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 72
security_domain: endpoint

Some files were not shown because too many files have changed in this diff Show More