diff --git a/detections/application/okta_mfa_exhaustion_hunt.yml b/detections/application/okta_mfa_exhaustion_hunt.yml index 5e3018879f..36de8ced91 100644 --- a/detections/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/application/okta_mfa_exhaustion_hunt.yml @@ -39,11 +39,11 @@ tags: asset_type: Infrastructure confidence: 60 impact: 30 - message: $src_user$ account has rejected multiple Okta pushes. + message: $user$ account has rejected multiple Okta pushes. mitre_attack_id: - T1110 observable: - - name: src_user + - name: user type: User role: - Attacker @@ -53,7 +53,7 @@ tags: - Splunk Cloud required_fields: - _time - - src_user + - user - src_ip - eventType - status diff --git a/detections/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/application/okta_two_or_more_rejected_okta_pushes.yml index dd7ea4203d..311a5559d6 100644 --- a/detections/application/okta_two_or_more_rejected_okta_pushes.yml +++ b/detections/application/okta_two_or_more_rejected_okta_pushes.yml @@ -33,11 +33,11 @@ tags: asset_type: Infrastructure confidence: 80 impact: 80 - message: $src_user$ account has rejected multiple Okta pushes. + message: $user$ account has rejected multiple Okta pushes. mitre_attack_id: - T1110 observable: - - name: src_user + - name: user type: User role: - Attacker @@ -47,7 +47,7 @@ tags: - Splunk Cloud required_fields: - _time - - src_user + - user - src_ip - eventType - status diff --git a/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml index 753ec43344..f2ca135af8 100644 --- a/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml +++ b/detections/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml @@ -30,7 +30,7 @@ tags: mitre_attack_id: - T1189 observable: - - name: User + - name: user type: User role: - Victim diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 702e625828..f4eb08f9fc 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -36,7 +36,7 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: Hostname + - name: host type: Hostname role: - Victim diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 338370a82d..cc2dfb78d6 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -38,7 +38,7 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: Hostname + - name: host type: Hostname role: - Victim diff --git a/detections/cloud/aws_exfiltration_via_batch_service.yml b/detections/cloud/aws_exfiltration_via_batch_service.yml index a82ad0634f..9a164540ff 100644 --- a/detections/cloud/aws_exfiltration_via_batch_service.yml +++ b/detections/cloud/aws_exfiltration_via_batch_service.yml @@ -2,12 +2,12 @@ name: AWS Exfiltration via Batch Service id: 04455dd3-ced7-480f-b8e6-5469b99e98e2 version: 1 date: '2023-04-24' -author: '' +author: Bhavin Patel, Splunk status: production type: TTP data_source: [] description: This search looks for events where AWS Batch Service is used for creating a job that could potentially abuse the AWS Bucket Replication feature on S3 buckets. This AWS service can used to transfer data between different AWS S3 buckets and an attacker can leverage this to exfiltrate data by creating a malicious batch job. -search: '`cloudtrail` eventName = JobCreated | stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' +search: '`cloudtrail` eventName = JobCreated | stats count min(_time) as firstTime max(_time) as lastTime values(serviceEventDetails.jobArn) as job_arn values(serviceEventDetails.status) as status by src_ip aws_account_id eventName errorCode userAgent| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_exfiltration_via_datasync_task_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: It is possible that an AWS Administrator or a user has legitimately created this job for some tasks. @@ -20,14 +20,10 @@ tags: asset_type: AWS Account confidence: 80 impact: 80 - message: AWS Batch Job is created on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ + message: AWS Batch Job is created on account id - $aws_account_id$ from src_ip $src_ip$ mitre_attack_id: - T1119 observable: - - name: user_arn - type: User - role: - - Attacker - name: src_ip type: IP Address role: diff --git a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml index ce77625e43..7bd0663985 100644 --- a/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml +++ b/detections/cloud/aws_exfiltration_via_ec2_snapshot.yml @@ -23,11 +23,11 @@ tags: asset_type: EC2 Snapshot confidence: 80 impact: 80 - message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $user_arn$ from src_ip $src_ip$ + message: Potential AWS EC2 Exfiltration detected on account id - $aws_account_id$ by user $userName$ from src_ip $src_ip$ mitre_attack_id: - T1537 observable: - - name: user_arn + - name: userName type: User role: - Attacker diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml index 5f4e109b21..9289505ac8 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -32,11 +32,7 @@ tags: mitre_attack_id: - T1201 observable: - - name: src_ip - type: IP Address - role: - - Attacker - - name: user_arn + - name: user_name type: User role: - Attacker diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 51e096eeaf..c237979df7 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -13,8 +13,8 @@ description: The following detection identifes when a policy is deleted on AWS. data_source: [] search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn) - as policyArn by src eventName eventSource aws_account_id errorCode errorMessage - userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)` + as policyArn by src user_arn eventName eventSource aws_account_id errorCode errorMessage + userAgent eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 298acf55f5..e2548632ec 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -12,7 +12,7 @@ description: Enforcing network-access controls is one of the defensive mechanism will query the AWS CloudTrail logs to detect users deleting network ACLs. data_source: [] search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false - | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index 942cdd9b0b..f88d9fdddf 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -52,10 +52,6 @@ tags: type: User role: - Victim - - name: ipAddress - type: IP Address - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index e1bad996bb..0ea877c255 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -37,11 +37,11 @@ tags: - T1098 observable: - name: userPrincipalName - type: Other + type: User Name role: - Victim - name: initiatedBy - type: User + type: User Name role: - Attacker product: diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index af9b5feb36..292aa73f4f 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -31,7 +31,7 @@ tags: asset_type: AWS Instance confidence: 60 impact: 70 - message: User $user$ is modifying an instance $dest$ for the first time. + message: User $user$ is modifying an instance $object_id$ for the first time. mitre_attack_id: - T1078.004 - T1078 @@ -40,10 +40,6 @@ tags: type: User role: - Attacker - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 7507a5ad98..ecfe277fb4 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -59,7 +59,7 @@ tags: type: IP Address role: - Attacker - - name: dest + - name: object type: Endpoint role: - Victim diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml index 0e4ab2a745..787757534a 100644 --- a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml +++ b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml @@ -46,10 +46,10 @@ tags: mitre_attack_id: - T1530 observable: - - name: dest - type: Other + - name: remote_ip + type: IP Address role: - - Other + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/detect_s3_access_from_a_new_ip.yml b/detections/cloud/detect_s3_access_from_a_new_ip.yml index 4a974e398a..7d0e3ea164 100644 --- a/detections/cloud/detect_s3_access_from_a_new_ip.yml +++ b/detections/cloud/detect_s3_access_from_a_new_ip.yml @@ -35,10 +35,10 @@ tags: mitre_attack_id: - T1530 observable: - - name: dest - type: Other + - name: src_ip + type: IP Address role: - - Other + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml index d8b1646bcc..06d8118388 100644 --- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml @@ -17,9 +17,7 @@ description: The following analytic identifies multiple failed multi-factor auth and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others. data_source: [] -search: ' `gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket - span=5m _time | stats dc(_raw) AS mfa_prompts values(user) by src_ip, login_challenge_method, _time - | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`' +search: "`gws_reports_login` event.name=login_failure `gws_login_mfa_methods` | bucket span=5m _time | stats dc(_raw) AS mfa_prompts values(user) AS user by src_ip, login_challenge_method, _time | where mfa_prompts >= 10 | `gcp_multiple_failed_mfa_requests_for_user_filter`" how_to_implement: You must install the latest version of Splunk Add-on for Google Workspace from Splunkbase (https://splunkbase.splunk.com/app/5556) which allows Splunk administrators to collect Google Workspace event data in Splunk using Google diff --git a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml index 72f798fbd7..98a3256e64 100644 --- a/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml +++ b/detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml @@ -38,14 +38,10 @@ tags: - T1048.003 - T1048 observable: - - name: source.address - type: User + - name: dest_domain + type: IP Address role: - Attacker - - name: destination{}.address - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/gsuite_suspicious_calendar_invite.yml b/detections/cloud/gsuite_suspicious_calendar_invite.yml index 9c793bc074..c6361c72bf 100644 --- a/detections/cloud/gsuite_suspicious_calendar_invite.yml +++ b/detections/cloud/gsuite_suspicious_calendar_invite.yml @@ -32,14 +32,14 @@ tags: asset_type: GSuite confidence: 50 impact: 50 - message: tbd + message: Gsuite suspicious calendar invite sent by $email$ mitre_attack_id: - T1566 observable: - - name: dest - type: Other + - name: email + type: Email Address role: - - Other + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 4c3c618e6c..a2024a7d5e 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -36,11 +36,7 @@ tags: - T1136.003 - T1136 observable: - - name: ActorIpAddress - type: IP Address - role: - - Attacker - - name: Actor.ID + - name: UserId type: User role: - Attacker diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 1f5573b54e..c01ae46697 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -30,14 +30,10 @@ tags: mitre_attack_id: - T1556 observable: - - name: dest - type: Endpoint - role: - - Victim - name: user type: User role: - - Attacker + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 96384e64ea..5da13f3ee0 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -14,7 +14,7 @@ description: This analytic is to detect a suspicious modification of the active valid setup installer that creating or modifying this registry. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'