attack datasets

detections/network/detect_outbound_ldap_traffic.yml

@@ -1,14 +1,13 @@
 name: Detect Outbound LDAP Traffic
 id: c77162d3-f91c-45cc-80c8-22f6v546119f
-version: 3
+version: 1
 date: '2021-12-13'
 author: Bhavin Patel, Johan Bjerke, Splunk
 type: Hunting
 datamodel:
 - Network_Traffic
 description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall.  This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space.
-search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip
-| `security_content_ctime(latest_time)`  | `security_content_ctime(earliest_time)`| `detect_outbound_ldap_traffic`'
+search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip | `security_content_ctime(latest_time)`  | `security_content_ctime(earliest_time)`| `detect_outbound_ldap_traffic`'
 how_to_implement: 'You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek
   data should also be getting ingested in JSON format and should be mapped to the The
   Network Resolution and Network Traffic datamodels are in use for this search.'
@@ -17,44 +16,37 @@ references:
   - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
 tags:
   analytic_story:
-  - Data Protection
-  - Prohibited Traffic Allowed or Protocol Mismatch
-  - DNS Hijacking
-  - Suspicious DNS Traffic
-  - Dynamic DNS
-  - Command and Control
+  - Log4Shell CVE-2021-44228
   asset_type: Endpoint
-  automated_detection_testing: passed
   cis20:
-  - CIS 8
   - CIS 12
   - CIS 13
   confidence: 80
   context:
-  - source:endpoint
-  - stage: Initial Access
+  - Source:Endpoint
+  - Stage:Initial Access
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log
+    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json
   impact: 70
   kill_chain_phases:
   - Command and Control
   - Actions on Objectives
-  message: A dns query $query$ from your infra connecting to suspicious domain in
-    host  $host$
+  message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$
   mitre_attack_id:
-  - T1189
+  - T1190
+  - T1059
   nist:
   - PR.DS
   - PR.PT
   - DE.AE
   - DE.CM
   observable:
-  - name: host
-    type: Hostname
+  - name: src_ip
+    type: IP Address
     role:
     - Victim
-  - name: query
-    type: dnsquery
+  - name: dest_ip
+    type: IP Address
     role:
     - Attacker
   product:
@@ -63,8 +55,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - DNS.answer
-  - DNS.query
-  - host
+  - All_Traffic.dest_ip
+  - All_Traffic.dest_port
+  - All_Traffic.src_ip
   risk_score: 56
   security_domain: network

tests/network/detect_outbound_ldap_traffic.test.yml

@@ -0,0 +1,13 @@
+name: Detect Outbound LDAP Traffic Unit Test
+tests:
+- name: Detect Outbound LDAP Traffic
+  file: network/detect_outbound_ldap_traffic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: stream_http_events.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_ldap/bro_conn.json
+    sourcetype: bro:conn:json
+
+