admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-10-04 13:51:46 -07:00
committed by GitHub
parent b13135bcac f7dcab2ed4
commit 1cc51a83a1
350 changed files with 6252 additions and 5949 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_core/application/factory/ba_factory.py
+1 -1
View File
@@ -99,7 +99,7 @@ class BAFactory():
if detection.status == "production":
if detection.status in ["production","validation"]:
self.output_dto.detections.append(detection)
else:
raise(Exception(f"Unsupported content type: [{type}]"))
bin/contentctl_project/contentctl_core/domain/entities/detection.py
+12
View File
@@ -75,6 +75,7 @@ class Detection(BaseModel, SecurityContentObject):
nes_fields: str = None
providing_technologies: list = None
runtime: str = None
internalVersion: str = None
# @validator('name')v
# def name_max_length(cls, v, values):
@@ -139,6 +140,17 @@ class Detection(BaseModel, SecurityContentObject):
if len(values["name"]) > 67:
raise ValueError("name is longer then 67 chars: " + values["name"])
return values
@root_validator
def validation_for_ba_only(cls, values):
# Ensure that only a BA detection can have status: validation
if values["status"] == "validation":
if "ssa_" not in values["file_path"]:
raise ValueError(f"The following is NOT an ssa_ detection, but has 'status: {values['status']} which may ONLY be used for ssa_ detections:' {values['file_path']}")
else:
#This is an ssa_ validation detection
pass
return values
@root_validator
bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py
+2
View File
@@ -40,7 +40,9 @@ class DetectionTags(BaseModel):
risk_level: str = None
observable_str: str = None
evidence_str: str = None
analytics_story_str: str = None
kill_chain_phases_id: list = None
kill_chain_phases_str: str = None
research_site_url: str = None
event_schema: str = None
mappings: list = None
bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py
+1
View File
@@ -59,3 +59,4 @@ class DetectionStatus(enum.Enum):
production = "production"
deprecated = "deprecated"
experimental = "experimental"
validation = "validation"
bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py
+42 -3
View File
@@ -10,6 +10,37 @@ class FindingReportObject():
@staticmethod
def writeFindingReport(detection : Detection) -> None:
if detection.tags.confidence < 33:
detection.tags.confidence_id = 1
elif detection.tags.confidence < 66:
detection.tags.confidence_id = 2
else:
detection.tags.confidence_id = 3
if detection.tags.impact < 20:
detection.tags.impact_id = 1
elif detection.tags.impact < 40:
detection.tags.impact_id = 2
elif detection.tags.impact < 60:
detection.tags.impact_id = 3
elif detection.tags.impact < 80:
detection.tags.impact_id = 4
else:
detection.tags.impact_id = 5
detection.tags.kill_chain_phases_id = dict()
for kill_chain_phase in detection.tags.kill_chain_phases:
detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase]
kill_chain_phase_str = "["
i = 0
for kill_chain_phase in detection.tags.kill_chain_phases_id.keys():
kill_chain_phase_str = kill_chain_phase_str + '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}"
if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1):
kill_chain_phase_str = kill_chain_phase_str + ', '
i = i + 1
kill_chain_phase_str = kill_chain_phase_str + ']'
detection.tags.kill_chain_phases_str = kill_chain_phase_str
if detection.tags.risk_score < 20:
detection.tags.risk_level_id = 0
@@ -27,15 +58,23 @@ class FindingReportObject():
detection.tags.risk_level_id = 4
detection.tags.risk_level = "Critical"
evidence_str = "create_map("
evidence_str = "{"
for i in range(len(detection.tags.observable)):
evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_")
evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '": ' + detection.tags.observable[i]["name"].replace(".", "_")
if not i == (len(detection.tags.observable) - 1):
evidence_str = evidence_str + ', '
evidence_str = evidence_str + ')'
evidence_str = evidence_str + '}'
detection.tags.evidence_str = evidence_str
analytics_story_str = "["
for i in range(len(detection.tags.analytic_story)):
analytics_story_str = analytics_story_str + '"' + detection.tags.analytic_story[i] + '"'
if not i == (len(detection.tags.analytic_story) - 1):
analytics_story_str = analytics_story_str + ', '
analytics_story_str = analytics_story_str + ']'
detection.tags.analytics_story_str = analytics_story_str
if "actor.user.name" in detection.tags.required_fields:
actor_user_name = "actor_user_name"
else:
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
+3 -1
View File
@@ -66,7 +66,8 @@ class ObjToYmlAdapter(Adapter):
"nist": obj.tags.nist
}
obj.runtime = "SPL-DSP"
obj.runtime = "SPL2"
obj.internalVersion = 2
# remove unncessary fields
YmlWriter.writeYmlFile(file_path, obj.dict(
@@ -84,6 +85,7 @@ class ObjToYmlAdapter(Adapter):
"known_false_positives": True,
"references": True,
"runtime": True,
"internalVersion": True,
"tags":
{
#"analytic_story": True,
bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2
+29 -27
View File
@@ -1,28 +1,30 @@
| eval body=create_map(
"devices", [
create_map(
"hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null)
)
],
"time", timestamp,
"evidence", {{ detection.tags.evidence_str }},
"message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", {{ actor_user_name }}, "."),
"users", [
create_map(
"name", {{ actor_user_name }}, "uid", ucast(map_get(actor_user,"uid"), "string", null)
)
],
"activity_id", 1,
"category_uid", 2,
"class_uid", 102001,
"risk_level_id", {{ detection.tags.risk_level_id }},
"risk_score", {{ detection.tags.risk_score }},
"severity_id", 0,
"rule", create_map("name", "{{ detection.name }}", "uid", "{{ detection.id }}", "type", "Streaming"),
"metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()),
"type_uid", 10200101,
"start_time", timestamp,
"end_time", timestamp
)
| into write_ba_finding_events();
| eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}],
time = timestamp,
evidence = {{ detection.tags.evidence_str }},
message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + {{ actor_user_name }} + ".",
users = [{"name": {{ actor_user_name }}, "uid": actor_user.uid}],
activity_id = 1,
cis_csc = [{"control": "CIS 10", "version": 8}],
analytic_stories = {{ detection.tags.analytics_story_str }},
class_name = "Detection Report",
confidence = {{ detection.tags.confidence }},
confidence_id = {{ detection.tags.confidence_id }},
duration = 0,
impact = {{ detection.tags.impact }},
impact_id = {{ detection.tags.impact_id }},
kill_chain = {{ detection.tags.kill_chain_phases_str }},
nist = ["DE.AE"],
risk_level = "{{ detection.tags.risk_level }}",
category_uid = 2,
class_uid = 102001,
risk_level_id = {{ detection.tags.risk_level_id }},
risk_score = {{ detection.tags.risk_score }},
severity_id = 0,
rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"},
metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()},
type_uid = 10200101,
start_time = timestamp,
end_time = timestamp
| fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time
| into sink;
bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py
+10 -15
View File
@@ -33,7 +33,7 @@ class SplunkBABackend(TextQueryBackend):
wildcard_single : ClassVar[str] = "%"
add_escaped : ClassVar[str] = "\\"
re_expression : ClassVar[str] = "match_regex({field}, /(?i){regex}/)=true"
re_expression : ClassVar[str] = "match({field}, /(?i){regex}/)=true"
re_escape_char : ClassVar[str] = ""
re_escape : ClassVar[Tuple[str]] = ('"',)
@@ -64,7 +64,7 @@ class SplunkBABackend(TextQueryBackend):
deferred_separator : ClassVar[str] = " OR "
deferred_only_query : ClassVar[str] = "*"
wildcard_match_expression : ClassVar[Optional[str]] = "like({field}, {value})"
wildcard_match_expression : ClassVar[Optional[str]] = "{field} LIKE {value}"
def __init__(self, processing_pipeline: Optional["sigma.processing.pipeline.ProcessingPipeline"] = None, collect_errors: bool = False, min_time : str = "-30d", max_time : str = "now", detection : Detection = None, field_mapping: dict = None, **kwargs):
@@ -88,32 +88,29 @@ class SplunkBABackend(TextQueryBackend):
# fields_input_parsing = fields_input_parsing + ', '
detection_str = """
| from read_ba_enriched_events()
| eval timestamp = ucast(map_get(input_event,"time"),"long", null)
| eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>", null)
| eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null)
$main = from source
| eval timestamp = time
| eval metadata_uid = metadata.uid
""".replace("\n", " ")
parsed_fields = []
for field in self.field_mapping["mapping"].keys():
mapped_field = self.field_mapping["mapping"][field]
parent = 'input_event'
parent = 'parent'
i = 1
values = mapped_field.split('.')
for val in values:
if parent == "input_event":
new_val = val
if parent == "parent":
parent = val
continue
else:
new_val = parent + '_' + val
if new_val in parsed_fields:
parent = new_val
i = i + 1
continue
if i == len(values):
parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "string", null) '
else:
parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "map<string, any>", null) '
parser_str = '| eval ' + new_val + ' = ' + parent + '.' + val + ' '
detection_str = detection_str + parser_str
parsed_fields.append(new_val)
parent = new_val
@@ -121,8 +118,6 @@ class SplunkBABackend(TextQueryBackend):
detection_str = detection_str + "| where " + query
detection_str = detection_str.replace("\\\\\\\\", "\\\\")
return detection_str
def finalize_output_data_model(self, queries: List[str]) -> List[str]:
detections/application/okta_risk_threshold_exceeded.yml
+3 -11
View File
@@ -8,9 +8,7 @@ type: Correlation
description:
The following correlation will take risk associated with the content
from "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories and
tally it up. Once it hits the threshold of 100 (may be changed), it will trigger
an anomaly. As needed, reduce or raise the risk scores assocaited with the anomaly
and TTP analytics tagged to these two stories.
tally it up. Once it hits the threshold of 100 (can be changed), it will trigger an a notable. As needed, reduce or raise the risk scores assocaited with the anomaly and TTP analytics tagged to these two analytic stories.
data_source: []
search:
'| tstats `security_content_summariesonly` sum(All_Risk.calculated_risk_score) as risk_score,
@@ -44,19 +42,13 @@ tags:
asset_type: Infrastructure
confidence: 80
impact: 70
message:
Risk threshold exceeded for $risk_object_type$=$risk_object$ related to
Okta events.
message: Risk score $risk_score$ threshold exceeded for $risk_object$ related to Okta events.
mitre_attack_id:
- T1078
- T1110
observable:
- name: risk_object
type: Other
role:
- Victim
- name: risk_object_type
type: Other
type: Hostname
role:
- Victim
product:
detections/application/splunk_absolute_path_traversal_using_runshellscript.yml
+58
View File
@@ -0,0 +1,58 @@
name: Splunk Absolute Path Traversal Using runshellscript
id: 356bd3fe-f59b-4f64-baa1-51495411b7ad
version: 1
date: '2023-09-05'
author: Rod Soto
status: production
type: Hunting
data_source: []
description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.
search: >
`splunk_python` *runshellscript*
| eval log_split=split(_raw, "runshellscript: ")
| eval array_raw = mvindex(log_split,1)
| eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","")
| eval array_indices=split(data_cleaned,",")
| eval runshellscript_args_count=mvcount(array_indices)
| where runshellscript_args_count = 10
| eval interpreter=mvindex(array_indices,0)
| eval targetScript=mvindex(array_indices,1)
| eval targetScript != "*C:*"
| stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter targetScript
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `splunk_absolute_path_traversal_using_runshellscript_filter`
how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions.
known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script.
references:
- https://advisory.splunk.com/advisories/SVD-2023-0806
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: endpoint
confidence: 70
impact: 50
message: Possible attack against splunk_server $splunk_server$ through abuse of the runshellscript command
mitre_attack_id:
- T1083
cve:
- CVE-2023-40597
observable:
- name: splunk_server
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 35
required_fields:
- search
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log
source: python.log
sourcetype: splunk_python
custom_index: _internal
detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
+2 -2
View File
@@ -14,7 +14,7 @@ description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cr
this vulnerability.
data_source: []
search: '`splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET"
delete_field_value="spacebridge_server" status="200" | table splunk_server status
delete_field_value="spacebridge_server" status="200" | table splunk_server status
uri delete_field_value method post_data | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`'
how_to_implement: Requires access to internal index.
known_false_positives: This hunting search only applies to the affected versions and
@@ -31,7 +31,7 @@ tags:
cve:
- CVE-2023-22942
impact: 50
message: Potential CSRF exploitation attempt from $host$
message: Potential CSRF exploitation attempt from $splunk_server$
mitre_attack_id:
- T1189
observable:
detections/application/splunk_dos_using_malformed_saml_request.yml
+46
View File
@@ -0,0 +1,46 @@
name: Splunk DoS Using Malformed SAML Request
id: 8e8a86d5-f323-4567-95be-8e817e2baee6
version: 1
date: '2023-09-05'
author: Rod Soto
status: production
type: Hunting
data_source: []
description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang.
search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr splunk_server event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`'
how_to_implement: To run this search, you must have access to the _internal index.
known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file.
references:
- https://advisory.splunk.com/advisories/SVD-2023-0802
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: endpoint
confidence: 30
impact: 50
message: Possible DoS attack against Splunk Server $splunk_server$
mitre_attack_id:
- T1498
observable:
- name: splunk_server
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 15
required_fields:
- component
- expr
- host
- event_message
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log
source: splunkd.log
sourcetype: splunkd
custom_index: _internal
detections/application/splunk_rce_via_serialized_session_payload.yml
+62
View File
@@ -0,0 +1,62 @@
name: Splunk RCE via Serialized Session Payload
id: d1d8fda6-874a-400f-82cf-dcbb59d8e4db
version: 1
date: '2023-10-02'
author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk
status: production
type: Hunting
description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that
they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code. The exploit requires the use
of the 'collect' SPL command which writes a file within the Splunk Enterprise installation. The attacker can then use this file to
submit a serialized payload that can result in execution of code within the payload. Please refer to the
following URL for additional information on these disclosures - https://advisory.splunk.com
data_source: []
search: '`audit_searches` file=* (search="*makeresults*" AND search="*collect*")
| stats count min(_time) as firstTime max(_time) as lastTime by action file user splunk_server search
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `splunk_rce_via_serialized_session_payload_filter`'
how_to_implement: Requires access to the _audit index.
known_false_positives: There are numerous many uses of the 'makeresults' and 'collect' SPL commands.
Please evaluate the results of this search for potential abuse.
references:
- https://www.splunk.com/en_us/product-security.html
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: Endpoint
confidence: 50
cve:
- CVE-2023-40595
impact: 50
message: Potential abuse of the 'collect' SPL command against $splunk_server$ by detected by $user$
mitre_attack_id:
- T1190
observable:
- name: user
type: User
role:
- Attacker
- name: splunk_server
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- search
- info
- user
- search_type
- count
risk_score: 25
security_domain: threat
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_rce_via_serialized_session_payload_audittrail.log
source: audittrail
sourcetype: audittrail
custom_index: _audit
detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml
+49
View File
@@ -0,0 +1,49 @@
name: Splunk Reflected XSS on App Search Table Endpoint
id: 182f9080-4137-4629-94ac-cb1083ac981a
version: 1
date: '2023-09-05'
author: Rod Soto
status: production
type: Hunting
data_source: []
description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the app search table web endpoint, which presents as the Create Table View page in Splunk Web. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. A JavaScript file within this web endpoint does not properly validate input which lets an attacker insert a payload into a function.
search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time) as firstTime max(_time) as lastTime by clientip status user view root uri_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`'
how_to_implement: Need access to the internal indexes.
known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string.
references:
- https://advisory.splunk.com/advisories/SVD-2023-0801
tags:
analytic_story:
- Splunk Vulnerabilities
asset_type: endpoint
confidence: 40
impact: 30
message: Possible XSS attack against from $user$
mitre_attack_id:
- T1189
observable:
- name: user
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
risk_score: 12
required_fields:
- dataset_commands
- clientip
- status
- user
- view
- root
- uri_path
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_on_app_search_table_endpoint_splunk_web_access.log
source: web_access.log
sourcetype: splunk_web_access
custom_index: _internal
detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml
+13 -2
View File
@@ -9,12 +9,15 @@ description: This search looks for a variety of high-risk commands throughout
a number of different Splunk Vulnerability Disclosures. Please refer to the
following URL for additional information on these disclosures - https://advisory.splunk.com
data_source: []
search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity
search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity
where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user
by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user
Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command
splunk_risky_command as search output splunk_risky_command description vulnerable_versions
CVE other_metadata | where splunk_risky_command != "false" | `splunk_risky_command_abuse_disclosed_february_2023_filter`'
CVE other_metadata | where splunk_risky_command != "false"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `splunk_risky_command_abuse_disclosed_february_2023_filter`'
how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel.
known_false_positives: This search encompasses many commands.
references:
@@ -32,10 +35,12 @@ tags:
- CVE-2023-22939
- CVE-2023-22940
- CVE-2023-40598
- CVE-2023-40598
impact: 50
message: Use of risky splunk command $splunk_risky_command$ detected by $user$
mitre_attack_id:
- T1548
- T1202
observable:
- name: user
type: User
@@ -67,6 +72,12 @@ tests:
- name: True Positive Test runshellscript abuse
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log
source: audittrail
sourcetype: audittrail
custom_index: _audit
- name: True Positive Test Additional runshellscript abuse
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log
source: audittrail
sourcetype: audittrail
custom_index: _audit
detections/cloud/aws_excessive_security_scanning.yml
+3 -5
View File
@@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events and analyse the amount
data_source: []
search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* |
stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
values(eventName) as eventName values(src) as src values(userAgent) as userAgent
values(eventName) as command values(src) as src values(userAgent) as userAgent
by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
@@ -25,9 +25,7 @@ tags:
asset_type: AWS Account
confidence: 60
impact: 30
message: user $user$ has excessive number of api calls $dc_events$ from these IP
addresses $src$, violating the threshold of 50, using the following commands
$command$.
message: User $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$.
mitre_attack_id:
- T1526
observable:
@@ -38,7 +36,7 @@ tags:
- name: user
type: User
role:
- Attacker
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+4 -10
View File
@@ -5,8 +5,7 @@ date: '2021-01-11'
author: Bhavin Patel, Patrick Bareiss, Splunk
status: production
type: TTP
description: The search looks for AWS CloudTrail events to detect if any network ACLs
were created with all the ports open to a specified CIDR.
description: The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
data_source: []
search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
@@ -14,7 +13,7 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1
| eval port_range=''requestParameters.portRange.to'' - ''requestParameters.portRange.from''
| where port_range>1024] | fillnull | stats count min(_time) as firstTime max(_time)
as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction
as lastTime by userName user_arn userIdentity.principalId eventName requestParameters.ruleAction
requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to
requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
@@ -31,8 +30,7 @@ tags:
asset_type: AWS Instance
confidence: 80
impact: 60
message: User $user_arn$ has created network ACLs with all the ports open to a specified
CIDR $requestParameters.cidrBlock$
message: User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
mitre_attack_id:
- T1562.007
- T1562
@@ -41,14 +39,10 @@ tags:
type: IP Address
role:
- Attacker
- name: userName
- name: user_arn
type: User
role:
- Victim
- name: requestParameters.cidrBlock
type: IP Address
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/cloud/aws_setdefaultpolicyversion.yml
+1 -1
View File
@@ -30,7 +30,7 @@ tags:
asset_type: AWS Account
confidence: 60
impact: 50
message: From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an
message: From IP address $src$, user $user_arn$ has trigged an
event $eventName$ for updating the the default policy version
mitre_attack_id:
- T1078.004
detections/cloud/aws_updateloginprofile.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
asset_type: AWS Account
confidence: 60
impact: 50
message: From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an
message: From IP address $src$, user agent $userAgent$ has trigged an
event $eventName$ for updating the existing login profile, potentially giving
user $user_arn$ more access privilleges
mitre_attack_id:
detections/cloud/azure_ad_user_enabled_and_password_reset.yml
+5 -5
View File
@@ -14,8 +14,8 @@ search: ' `azuread` (operationName="Enable account" OR operationName="Reset pass
OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName
startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m
| rename properties.* as * | rename targetResources{}.userPrincipalName
as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
| stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName,
as user | rename initiatedBy.user.userPrincipalName as initiatedBy
| stats values(operationName) values(initiatedBy) as initiatedBy by _time, user,
result | `azure_ad_user_enabled_and_password_reset_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
@@ -36,12 +36,12 @@ tags:
mitre_attack_id:
- T1098
observable:
- name: userPrincipalName
type: User Name
- name: user
type: User
role:
- Victim
- name: initiatedBy
type: User Name
type: User
role:
- Attacker
product:
detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml
+2 -2
View File
@@ -46,7 +46,7 @@ tags:
asset_type: AWS Instance
confidence: 60
impact: 30
message: User $user$ is starting or creating an instance $dest$ for the first time
message: User $user$ is starting or creating an instance $object$ for the first time
in City $City$ from IP address $src$
mitre_attack_id:
- T1078
@@ -54,7 +54,7 @@ tags:
- name: user
type: User
role:
- Attacker
- Victim
- name: src
type: IP Address
role:
detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
+1 -2
View File
@@ -36,8 +36,7 @@ tags:
asset_type: Google Cloud Platform tenant
confidence: 90
impact: 60
message: Multiple failed login attempts against users $tried_accounts$ seen from
$src_ip$
message: Multiple failed login attempts against users $tried_accounts$ seen from $src$
mitre_attack_id:
- T1586
- T1586.003
detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
+1 -1
View File
@@ -44,7 +44,7 @@ tags:
confidence: 90
impact: 60
message: Unusual number of failed console login attempts against users $tried_accounts$
seen from $src_ip$
seen from $src$
mitre_attack_id:
- T1586
- T1586.003
detections/cloud/o365_add_app_role_assignment_grant_user.yml
+4 -5
View File
@@ -11,7 +11,7 @@ description: This search is designed to detect the creation of a new Federation
providing an additional layer of security for your environment.
data_source: []
search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user."
| stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by UserId dest ResultStatus
| stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type values(ModifiedProperties{}.Name) as modified_properties_name by user dest ResultStatus Operation
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_add_app_role_assignment_grant_user_filter`'
@@ -30,16 +30,15 @@ tags:
asset_type: Office 365
confidence: 60
impact: 30
message: User $Actor.ID$ has created a new federation setting on $dest$ from IP
Address $ActorIpAddress$
message: User $user$ has created a new federation setting $modified_properties_name$ on $dest$
mitre_attack_id:
- T1136.003
- T1136
observable:
- name: UserId
- name: user
type: User
role:
- Attacker
- Victim
- name: dest
type: Endpoint
role:
detections/cloud/o365_disable_mfa.yml
+1 -2
View File
@@ -25,8 +25,7 @@ tags:
asset_type: Office 365
confidence: 80
impact: 80
message: User $user$ has executed an operation $Operation$ for this destination
$dest$
message: User $src_user$ has executed an operation $action$ for user $user$
mitre_attack_id:
- T1556
observable:
detections/cloud/o365_excessive_sso_logon_errors.yml
+3 -5
View File
@@ -6,10 +6,9 @@ author: Rod Soto, Splunk
status: production
type: Anomaly
description: The following analytic detects accounts with high number of Single Sign ON (SSO)
logon errors. Excessive logon errors may indicate attempts to bruteforce of password
or single sign on token hijack or reuse.
logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse.
data_source: []
search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed | stats count min(_time) as firstTime max(_time) as lastTime by user src_ip LogonError user_agent UserId Operation Workload authentication_method authentication_service| where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`'
search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip signature user_agent authentication_service action| where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
works with o365:management:activity
known_false_positives: Logon errors may not be malicious in nature however it may
@@ -23,8 +22,7 @@ tags:
asset_type: Office 365
confidence: 80
impact: 80
message: User $user$ has caused excessive number of SSO logon errors from $src_ip$
using UserAgent $UserAgent$.
message: Excessive number of SSO logon errors from $src_ip$ using UserAgent $user_agent$.
mitre_attack_id:
- T1556
observable:
detections/deprecated/detect_mimikatz_using_loaded_images.yml
+7 -17
View File
@@ -3,17 +3,15 @@ id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
version: 1
date: '2019-12-03'
author: Patrick Bareiss, Splunk
status: production
status: deprecated
type: TTP
description: This search looks for reading loaded Images unique to credential dumping
with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon
Event Code.
with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code.
data_source:
- Sysmon Event ID 7
search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId)
as ProcessId by Computer, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll
ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename
Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
as ProcessId by dest, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll
ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `detect_mimikatz_using_loaded_images_filter`'
how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
includes EventCode 7 with powershell.exe. This search uses an input macro named
@@ -40,7 +38,7 @@ tags:
confidence: 80
impact: 80
message: A process, $Image$, has loaded $ImageLoaded$ that are typically related
to credential dumping on $Computer$. Review for further details.
to credential dumping on $dest$. Review for further details.
mitre_attack_id:
- T1003.001
- T1003
@@ -49,18 +47,10 @@ tags:
type: User
role:
- Victim
- name: Computer
- name: dest
type: Hostname
role:
- Victim
- name: ImageLoaded
type: Process
role:
- Other
- name: Image
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -70,7 +60,7 @@ tags:
- EventCode
- ImageLoaded
- ProcessId
- Computer
- dest
- Image
risk_score: 64
security_domain: endpoint
detections/deprecated/dump_lsass_via_procdump_rename.yml
+2 -3
View File
@@ -17,8 +17,7 @@ description: 'Detect a renamed instance of procdump.exe dumping the lsass proces
data_source:
- Sysmon Event ID 1
search: '`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1
(CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as
dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
(CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,
process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
@@ -64,7 +63,7 @@ tags:
- process_name
- EventID
- CommandLine
- Computer
- dest
- parent_process_name
risk_score: 80
security_domain: endpoint
detections/deprecated/unsigned_image_loaded_by_lsass.yml
+2 -2
View File
@@ -10,8 +10,8 @@ description: This search detects loading of unsigned images by LSASS. Deprecated
data_source:
- Sysmon Event ID 7
search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time)
as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1
| rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
as firstTime max(_time) as lastTime by dest, Image, ImageLoaded, Signed, SHA1
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `unsigned_image_loaded_by_lsass_filter` '
how_to_implement: This search needs Sysmon Logs with a sysmon configuration, which
includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`.
detections/endpoint/access_lsass_memory_for_dump_creation.yml
+3 -3
View File
@@ -9,8 +9,8 @@ description: The following analytic is designed to detect potentially malicious
data_source:
- Sysmon Event ID 1
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll*
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`|
| stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage,
TargetProcessId, SourceImage, SourceProcessId | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` '
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`.
@@ -53,7 +53,7 @@ tags:
- EventCode
- TargetImage
- CallTrace
- Computer
- dest
- TargetProcessId
- SourceImage
- SourceProcessId
detections/endpoint/adsisearcher_account_discovery.yml
+4 -4
View File
@@ -13,7 +13,7 @@ data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText
= "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Computer ScriptBlockText UserID
as firstTime max(_time) as lastTime by EventCode Computer ScriptBlockText UserID | rename Computer as dest, UserID as user
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -31,16 +31,16 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: powershell process having commandline $Message$ for user enumeration
message: Powershell process having commandline "AdsiSearcher" used for user enumeration on $dest$
mitre_attack_id:
- T1087.002
- T1087
observable:
- name: Computer
- name: dest
type: Hostname
role:
- Victim
- name: UserID
- name: user
type: User
role:
- Victim
detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+1
View File
@@ -29,6 +29,7 @@ tags:
- Prohibited Traffic Allowed or Protocol Mismatch
- Windows Registry Abuse
- Azorult
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/allow_network_discovery_in_firewall.yml
+1
View File
@@ -37,6 +37,7 @@ tags:
- Ransomware
- Revil Ransomware
- BlackByte Ransomware
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/cmd_carry_out_string_command_parameter.yml
+3 -3
View File
@@ -15,7 +15,7 @@ data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="*
/c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
/c *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `cmd_carry_out_string_command_parameter_filter`'
@@ -50,14 +50,14 @@ tags:
- Azorult
- Data Destruction
- Warzone RAT
- NjRAT
asset_type: Endpoint
automated_detection_testing: passed
confidence: 50
cve:
- CVE-2021-44228
impact: 60
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting spawn a new process.
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process.
mitre_attack_id:
- T1059.003
- T1059
detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
+2 -2
View File
@@ -13,7 +13,7 @@ data_source:
search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll",
"*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*",
"*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime
by dest Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)`
by dest Image ImageLoaded process_name EventCode Signed ProcessId | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name and imageloaded executions from your endpoints. If you
@@ -49,7 +49,7 @@ tags:
- Image
- ImageLoaded
- process_name
- Computer
- dest
- EventCode
- Signed
- ProcessId
detections/endpoint/cobalt_strike_named_pipes.yml
+2 -3
View File
@@ -22,8 +22,7 @@ data_source:
search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*,
\\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*,
\\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime
by Computer, process_name, process_id process_path, PipeName | rename Computer as
dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
by dest, process_name, process_id process_path, PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `cobalt_strike_named_pipes_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
@@ -70,7 +69,7 @@ tags:
- _time
- EventID
- PipeName
- Computer
- dest
- process_name
- process_path
- process_id
detections/endpoint/create_remote_thread_in_shell_application.yml
+4 -4
View File
@@ -13,7 +13,7 @@ data_source:
- Sysmon Event ID 8
search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats
count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId
SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)`
SourceProcessId EventCode StartAddress SourceImage dest | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
@@ -31,11 +31,11 @@ tags:
confidence: 100
impact: 70
message: process $SourceImage$ create a remote thread to shell app process $TargetImage$
in host $Computer$
in host $dest$
mitre_attack_id:
- T1055
observable:
- name: Computer
- name: dest
type: Hostname
role:
- Victim
@@ -55,7 +55,7 @@ tags:
- SourceProcessId
- StartAddress
- EventCode
- Computer
- dest
risk_score: 70
security_domain: endpoint
tests:
detections/endpoint/create_remote_thread_into_lsass.yml
+2 -3
View File
@@ -9,8 +9,7 @@ description: The following analytic developed to detect potential credential dum
data_source:
- Sysmon Event ID 8
search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime
max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename
Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
max(_time) as lastTime by dest, EventCode, TargetImage, TargetProcessId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `create_remote_thread_into_lsass_filter`'
how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which
includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`.
@@ -50,7 +49,7 @@ tags:
- _time
- EventID
- TargetImage
- Computer
- dest
- EventCode
- TargetImage
- TargetProcessId
detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+3 -3
View File
@@ -13,8 +13,8 @@ description: Detect the hands on keyboard behavior of Windows Task Manager creat
data_source:
- Sysmon Event ID 1
search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp |
stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category,
process_name, TargetFilename | rename Computer as dest | `security_content_ctime(firstTime)`
stats count min(_time) as firstTime max(_time) as lastTime by dest, object_category,
process_name, TargetFilename | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`'
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
includes EventCode 11 for detecting file create of lsass.dmp. This search uses an
@@ -54,7 +54,7 @@ tags:
- EventID
- process_name
- TargetFilename
- Computer
- dest
- object_category
risk_score: 80
security_domain: endpoint
detections/endpoint/creation_of_shadow_copy.yml
+1 -1
View File
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe
Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user
Processes.process_name Processes.process Processes.parent_process Processes.process_id
Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
detections/endpoint/detect_certify_with_powershell_script_block_logging.yml
+1 -1
View File
@@ -39,7 +39,7 @@ tags:
role:
- Victim
- name: user
type: User Name
type: User
role:
- Victim
- name: command
detections/endpoint/detect_credential_dumping_through_lsass_access.yml
+4 -5
View File
@@ -10,9 +10,8 @@ description: This search looks for reading lsass memory consistent with credenti
data_source:
- Sysmon Event ID 1
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410)
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| stats count min(_time) as firstTime max(_time) as lastTime by dest, SourceImage,
SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `detect_credential_dumping_through_lsass_access_filter` '
how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`.
@@ -32,7 +31,7 @@ tags:
asset_type: Windows
confidence: 100
impact: 80
message: The $source_image$ has attempted access to read $TargetImage$ was identified
message: The $SourceImage$ has attempted access to read $TargetImage$ was identified
on endpoint $dest$, this is indicative of credential dumping and should be
investigated.
mitre_attack_id:
@@ -56,7 +55,7 @@ tags:
- EventCode
- TargetImage
- GrantedAccess
- Computer
- dest
- SourceImage
- SourceProcessId
- TargetImage
detections/endpoint/detect_excessive_user_account_lockouts.yml
+1 -6
View File
@@ -26,8 +26,7 @@ tags:
asset_type: Windows
confidence: 60
impact: 60
message: Multiple accounts have been locked out. Review $nodename$ and $result$
related to $user$.
message: Excessive user account lockouts for $user$ in a short period of time
mitre_attack_id:
- T1078
- T1078.003
@@ -36,10 +35,6 @@ tags:
type: User
role:
- Victim
- name: result
type: Other
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/detect_html_help_renamed.yml
+2 -3
View File
@@ -46,8 +46,7 @@ tags:
asset_type: Endpoint
confidence: 100
impact: 80
message: The following $process_name$ has been identified as renamed, spawning from
$parent_process_name$.
message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ executed by $user$
mitre_attack_id:
- T1218
- T1218.001
@@ -56,7 +55,7 @@ tags:
type: User
role:
- Victim
- name: Computer
- name: dest
type: Hostname
role:
- Victim
detections/endpoint/detect_mshta_renamed.yml
+2 -3
View File
@@ -39,8 +39,7 @@ tags:
asset_type: Endpoint
confidence: 100
impact: 80
message: The following $process_name$ has been identified as renamed, spawning from
$parent_process_name$.
message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ executed by user $user$
mitre_attack_id:
- T1218
- T1218.005
@@ -49,7 +48,7 @@ tags:
type: User
role:
- Victim
- name: Computer
- name: dest
type: Hostname
role:
- Victim
detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+2 -3
View File
@@ -36,8 +36,7 @@ tags:
asset_type: Endpoint
confidence: 100
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ running prohibited applications.
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications.
mitre_attack_id:
- T1059
- T1059.003
@@ -46,7 +45,7 @@ tags:
type: User
role:
- Victim
- name: Computer
- name: dest
type: Hostname
role:
- Victim
detections/endpoint/detect_regasm_with_network_connection.yml
+3 -3
View File
@@ -18,7 +18,7 @@ description: The following analytic identifies regasm.exe with a network connect
data_source:
- Sysmon Event ID 3
search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime
process_name=regasm.exe | stats count min(_time) as firstTime
max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
@@ -40,7 +40,7 @@ tags:
confidence: 100
impact: 80
message: An instance of $process_name$ contacting a remote destination was identified
on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
mitre_attack_id:
- T1218
- T1218.009
@@ -66,7 +66,7 @@ tags:
- EventID
- dest_ip
- process_name
- Computer
- dest
- user
- src_ip
- dest_host
detections/endpoint/detect_regsvcs_with_network_connection.yml
+3 -3
View File
@@ -18,7 +18,7 @@ description: The following analytic identifies Regsvcs.exe with a network connec
data_source:
- Sysmon Event ID 3
search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime
process_name=regsvcs.exe | stats count min(_time) as firstTime
max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
@@ -40,7 +40,7 @@ tags:
confidence: 100
impact: 80
message: An instance of $process_name$ contacting a remote destination was identified
on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$.
mitre_attack_id:
- T1218
- T1218.009
@@ -66,7 +66,7 @@ tags:
- EventID
- dest_ip
- process_name
- Computer
- dest
- user
- src_ip
- dest_host
detections/endpoint/detect_webshell_exploit_behavior.yml
+1
View File
@@ -49,6 +49,7 @@ tags:
- CISA AA22-264A
- Citrix ShareFile RCE CVE-2023-24489
- Flax Typhoon
- WS FTP Server Critical Vulnerabilities
asset_type: Endpoint
confidence: 80
impact: 100
detections/endpoint/detect_wmi_event_subscription_persistence.yml
+1 -1
View File
@@ -64,7 +64,7 @@ tags:
required_fields:
- _time
- Destination
- Computer
- dest
- User
risk_score: 63
security_domain: endpoint
detections/endpoint/disable_registry_tool.yml
+1
View File
@@ -29,6 +29,7 @@ tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
asset_type: Endpoint
confidence: 100
impact: 40
detections/endpoint/disabling_cmd_application.yml
+1
View File
@@ -28,6 +28,7 @@ tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/disabling_systemrestore_in_registry.yml
+1
View File
@@ -31,6 +31,7 @@ tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 70
detections/endpoint/disabling_task_manager.yml
+1
View File
@@ -29,6 +29,7 @@ tags:
analytic_story:
- Windows Defense Evasion Tactics
- Windows Registry Abuse
- NjRAT
asset_type: Endpoint
confidence: 60
impact: 70
detections/endpoint/download_files_using_telegram.yml
+3 -3
View File
@@ -13,8 +13,8 @@ description: The following analytic will identify a suspicious download by the T
data_source:
- Sysmon Event ID 15
search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
|stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode
Image process_id TargetFilename Hash | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|stats count min(_time) as firstTime max(_time) as lastTime by dest EventCode
process_name process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `download_files_using_telegram_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name and TargetFilename from your endpoints or Events that
@@ -45,7 +45,7 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Computer
- dest
- EventCode
- Image
- process_id
detections/endpoint/drop_icedid_license_dat.yml
+5 -5
View File
@@ -12,7 +12,7 @@ data_source:
- Sysmon Event ID 11
search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*"
OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time)
as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)`
as lastTime by TargetFilename EventCode process_id process_name dest | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
@@ -27,16 +27,16 @@ tags:
asset_type: Endpoint
confidence: 90
impact: 70
message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
message: A process $process_name$ created a file $TargetFilename$ on host $dest$
mitre_attack_id:
- T1204
- T1204.002
observable:
- name: Computer
- name: dest
type: Hostname
role:
- Victim
- name: SourceImage
- name: process_name
type: Process
role:
- Attacker
@@ -53,4 +53,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/elevated_group_discovery_with_powerview.yml
+1 -1
View File
@@ -17,7 +17,7 @@ data_source:
search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message
IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*"
, "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | rename ComputerName as dest, User as user | `security_content_ctime(firstTime)`
| `elevated_group_discovery_with_powerview_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
+4 -4
View File
@@ -15,7 +15,7 @@ data_source:
- Sysmon Event ID 23
search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows
Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime
max(_time) as lastTime count by user EventCode Image ProcessID Computer |where count
max(_time) as lastTime count by user EventCode Image ProcessID dest |where count
>=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `excessive_file_deletion_in_windefender_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
@@ -33,7 +33,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: High frequency file deletion activity detected on host $Computer$
message: High frequency file deletion activity detected on host $dest$
mitre_attack_id:
- T1485
observable:
@@ -41,7 +41,7 @@ tags:
type: User
role:
- Victim
- name: Computer
- name: dest
type: Endpoint
role:
- Victim
@@ -57,7 +57,7 @@ tags:
- _time
- EventCode
- TargetFilename
- Computer
- dest
- user
- Image
- ProcessID
detections/endpoint/excessive_usage_of_nslookup_app.yml
+5 -5
View File
@@ -14,8 +14,8 @@ description: This search is to detect potential DNS exfiltration using nslookup
data_source:
- Sysmon Event ID 1
search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=1m
| stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as
avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer |
| stats count as numNsLookup by dest, _time | eventstats avg(numNsLookup) as
avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by dest |
eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(numNsLookup
> 20 and numNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`'
@@ -37,12 +37,12 @@ tags:
asset_type: Endpoint
confidence: 70
impact: 40
message: Excessive usage of nslookup.exe has been detected on $Computer$. This detection
message: Excessive usage of nslookup.exe has been detected on $dest$. This detection
is triggered as as it violates the dynamic threshold
mitre_attack_id:
- T1048
observable:
- name: Computer
- name: dest
type: Endpoint
role:
- Victim
@@ -52,7 +52,7 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Computer
- dest
- process_name
- EventCode
risk_score: 28
detections/endpoint/excessive_usage_of_sc_service_utility.yml
+3 -3
View File
@@ -12,8 +12,8 @@ description: This search is to detect a suspicious excessive usage of sc.exe in
data_source:
- Sysmon Event ID 1
search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m |
stats values(process) as process count as numScExe by Computer, _time | eventstats
avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer
stats values(process) as process count as numScExe by dest, _time | eventstats
avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by dest
| eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe >
5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`'
@@ -37,7 +37,7 @@ tags:
- T1569
- T1569.002
observable:
- name: Computer
- name: dest
type: Endpoint
role:
- Victim
detections/endpoint/excessive_usage_of_taskkill.yml
+1
View File
@@ -36,6 +36,7 @@ tags:
- CISA AA22-264A
- AgentTesla
- CISA AA22-277A
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 40
detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+1
View File
@@ -62,6 +62,7 @@ tags:
- Amadey
- BlackByte Ransomware
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 40
detections/endpoint/firewall_allowed_program_enable.yml
+1
View File
@@ -38,6 +38,7 @@ tags:
- Windows Defense Evasion Tactics
- Azorult
- BlackByte Ransomware
- NjRAT
asset_type: Endpoint
confidence: 50
impact: 50
detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+4 -5
View File
@@ -14,7 +14,7 @@ data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -30,16 +30,15 @@ tags:
asset_type: Endpoint
confidence: 30
impact: 30
message: powershell process having commandline $Message$ to query domain password
policy
message: Powershell process having commandline "Get-ADDefaultDomainPasswordPolicy" to query domain password policy on $dest$
mitre_attack_id:
- T1201
observable:
- name: ComputerName
- name: dest
type: Hostname
role:
- Victim
- name: User
- name: user
type: User
role:
- Victim
detections/endpoint/get_aduser_with_powershell_script_block.yml
+4 -4
View File
@@ -14,7 +14,7 @@ data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText
= "*-filter*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
ScriptBlockText Computer UserID | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `get_aduser_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -30,16 +30,16 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: powershell process having commandline $Message$ for user enumeration
message: Powershell process having commandline "get-aduser" for user enumeration on $dest$
mitre_attack_id:
- T1087.002
- T1087
observable:
- name: ComputerName
- name: dest
type: Hostname
role:
- Victim
- name: User
- name: user
type: User
role:
- Victim
detections/endpoint/get_domainuser_with_powershell_script_block.yml
+4 -4
View File
@@ -14,7 +14,7 @@ data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" | stats
count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
Computer UserID | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `get_domainuser_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -28,16 +28,16 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 50
message: powershell process having commandline $Message$ for user enumeration
message: Powershell process having commandline "*Get-DomainUser*" for user enumeration on $dest$
mitre_attack_id:
- T1087.002
- T1087
observable:
- name: Computer
- name: dest
type: Hostname
role:
- Victim
- name: UserID
- name: user
type: User
role:
- Victim
detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
+1 -1
View File
@@ -22,7 +22,7 @@ data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText
= "*Win32_Group*" | stats count min(_time) as firstTime max(_time) as lastTime by
EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)`
EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_with_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
detections/endpoint/getadgroup_with_powershell_script_block.yml
+3 -4
View File
@@ -13,8 +13,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*" | stats count
min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `getadgroup_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -47,8 +46,8 @@ tags:
- _time
- EventCode
- Message
- ComputerName
- User
- Computer
- UserID
risk_score: 15
security_domain: endpoint
tests:
detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+2 -2
View File
@@ -14,7 +14,7 @@ data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*" ScriptBlockText
= "*GetCurrent()*" | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)`
by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,7 +30,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 30
message: System user discovery on $dest$
message: System user discovery on $dest$ by $user$
mitre_attack_id:
- T1033
observable:
detections/endpoint/high_process_termination_frequency.yml
+4 -4
View File
@@ -13,7 +13,7 @@ description: This analytic is designed to identify a high frequency of process t
data_source:
- Sysmon Event ID 5
search: '`sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated
min(_time) as firstTime max(_time) as lastTime count by _time Computer EventCode
min(_time) as firstTime max(_time) as lastTime count by _time dest EventCode
ProcessID | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `high_process_termination_frequency_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
@@ -32,11 +32,11 @@ tags:
confidence: 80
impact: 90
message: High frequency process termination (more than 15 processes within 3s) detected
on host $Computer$
on host $dest$
mitre_attack_id:
- T1486
observable:
- name: Computer
- name: dest
type: Endpoint
role:
- Victim
@@ -51,7 +51,7 @@ tags:
required_fields:
- EventCode
- Image
- Computer
- dest
- _time
- ProcessID
risk_score: 72
detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
+6 -6
View File
@@ -12,7 +12,7 @@ data_source:
- Sysmon Event ID 11
search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename
= "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by
TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)`
TargetFilename EventCode process_id process_name dest | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
@@ -27,16 +27,16 @@ tags:
asset_type: Endpoint
confidence: 90
impact: 80
message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
message: Process $process_name$ create a file $TargetImage$ on host $dest$
mitre_attack_id:
- T1560.001
- T1560
observable:
- name: Computer
- name: dest
type: Hostname
role:
- Victim
- name: SourceImage
- name: process_name
type: Process
role:
- Attacker
@@ -50,7 +50,7 @@ tags:
- EventCode
- process_id
- process_name
- Computer
- dest
risk_score: 72
security_domain: endpoint
tests:
@@ -58,4 +58,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
+1 -2
View File
@@ -44,8 +44,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 90
message: A Kerberos Service TTicket request with RC4 encryption was requested from
$Client_Address$
message: A Kerberos Service TTicket request with RC4 encryption was requested from $dest$
mitre_attack_id:
- T1558
- T1558.001
detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml
+5 -1
View File
@@ -35,7 +35,7 @@ tags:
asset_type: endpoint
confidence: 70
impact: 70
message: a $process_name$ deleting a SSH key in $dest$
message: SSH Config and keys are deleted on $dest$ by Process GUID - $process_guid$
mitre_attack_id:
- T1485
- T1070.004
@@ -45,6 +45,10 @@ tags:
type: Hostname
role:
- Victim
- name: process_guid
type: Process
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/linux_deletion_of_cron_jobs.yml
+5 -1
View File
@@ -35,7 +35,7 @@ tags:
asset_type: endpoint
confidence: 70
impact: 70
message: a $process_name$ deleting cron jobs in $dest$
message: Linux cron jobs are deleted on host $dest$ by process GUID- $process_guid$
mitre_attack_id:
- T1485
- T1070.004
@@ -45,6 +45,10 @@ tags:
type: Hostname
role:
- Victim
- name: process_guid
type: Process
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/linux_deletion_of_init_daemon_script.yml
+5 -1
View File
@@ -37,7 +37,7 @@ tags:
asset_type: endpoint
confidence: 70
impact: 70
message: a $process_name$ deleting a daemon script in $dest$
message: Init daemon script deleted on host $dest$ by process GUID- $process_guid$
mitre_attack_id:
- T1485
- T1070.004
@@ -47,6 +47,10 @@ tags:
type: Hostname
role:
- Victim
- name: process_guid
type: Process
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/linux_deletion_of_services.yml
+5 -1
View File
@@ -39,7 +39,7 @@ tags:
asset_type: endpoint
confidence: 80
impact: 80
message: a $process_name$ deleting a services in $dest$
message: A services file $file_name$ deteted on host $dest$ by process GUID - $process_guid$
mitre_attack_id:
- T1485
- T1070.004
@@ -49,6 +49,10 @@ tags:
type: Hostname
role:
- Victim
- name: process_guid
type: Process
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/linux_deletion_of_ssl_certificate.yml
+5 -1
View File
@@ -36,7 +36,7 @@ tags:
asset_type: endpoint
confidence: 70
impact: 70
message: a $process_name$ deleting a SSL certificate in $dest$
message: SSL certificate deleted on host $dest$ by process GUID- $process_guid$
mitre_attack_id:
- T1485
- T1070.004
@@ -46,6 +46,10 @@ tags:
type: Hostname
role:
- Victim
- name: process_guid
type: Process
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml
+5 -1
View File
@@ -36,7 +36,7 @@ tags:
asset_type: endpoint
confidence: 80
impact: 100
message: a $process_name$ deleting multiple files in /boot/ folder in $dest$
message: Multiple files detection in /boot/ folder on $dest$ by process GUID - $process_guid$
mitre_attack_id:
- T1485
- T1070.004
@@ -46,6 +46,10 @@ tags:
type: Hostname
role:
- Victim
- name: process_guid
type: Process
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml
+5 -1
View File
@@ -35,7 +35,7 @@ tags:
asset_type: endpoint
confidence: 70
impact: 70
message: a $process_name$ deleting multiple files in /etc/ folder in $dest$
message: Multiple files delted in /etc/ folder on $dest$ by process GUID - $process_guid$
mitre_attack_id:
- T1485
- T1070.004
@@ -45,6 +45,10 @@ tags:
type: Hostname
role:
- Victim
- name: process_guid
type: Process
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/loading_of_dynwrapx_module.yml
+4 -4
View File
@@ -18,7 +18,7 @@ data_source:
search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName
= "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime
max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name
Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `loading_of_dynwrapx_module_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on processes that include the name of the process responsible for the changes from
@@ -43,12 +43,12 @@ tags:
asset_type: Endpoint
confidence: 100
impact: 80
message: dynwrapx.dll loaded by process $process_name$ on $Computer$
message: dynwrapx.dll loaded by process $process_name$ on $dest$
mitre_attack_id:
- T1055
- T1055.001
observable:
- name: Computer
- name: dest
type: Endpoint
role:
- Victim
@@ -63,7 +63,7 @@ tags:
- OriginalFileName
- Product
- process_name
- Computer
- dest
- EventCode
- Signed
- ProcessId
detections/endpoint/modification_of_wallpaper.yml
+2 -2
View File
@@ -14,7 +14,7 @@ data_source:
search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper"
AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper"
AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode Image TargetObject Details Computer process_guid process_id
lastTime by EventCode Image TargetObject Details Computer process_guid process_id
user_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `modification_of_wallpaper_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
@@ -54,7 +54,7 @@ tags:
- Image
- TargetObject
- Details
- Computer
- dest
- process_guid
- process_id
- user_id
detections/endpoint/ms_scripting_process_loading_ldap_module.yml
+1 -1
View File
@@ -54,7 +54,7 @@ tags:
- process_name
- ProcessId
- ProcessGuid
- Computer
- dest
- ImageLoaded
risk_score: 9
security_domain: endpoint
detections/endpoint/ms_scripting_process_loading_wmi_module.yml
+1 -1
View File
@@ -55,7 +55,7 @@ tags:
- process_name
- ProcessId
- ProcessGuid
- Computer
- dest
- ImageLoaded
risk_score: 9
security_domain: endpoint
detections/endpoint/mshtml_module_load_in_office_product.yml
+2 -2
View File
@@ -14,8 +14,8 @@ data_source:
- Sysmon Event ID 7
search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe",
"msaccess.exe","Graph.exe","winproj.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`
| stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name,
ImageLoaded, OriginalFileName, ProcessGuid | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process names and image loads from your endpoints. If you are using
detections/endpoint/msi_module_loaded_by_non_system_binary.yml
+3 -3
View File
@@ -27,7 +27,7 @@ data_source:
- Sysmon Event ID 7
search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*",
"*\\winsxs\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by
Image ImageLoaded process_name Computer EventCode ProcessId | `security_content_ctime(firstTime)`
Image ImageLoaded process_name dest EventCode ProcessId | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `msi_module_loaded_by_non_system_binary_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name and imageloaded executions from your endpoints. If you
@@ -49,7 +49,7 @@ tags:
- CVE-2021-41379
impact: 80
message: The following module $ImageLoaded$ was loaded by $Image$ outside of the
normal system paths on endpoint $Computer$, potentally related to DLL side-loading.
normal system paths on endpoint $dest$, potentally related to DLL side-loading.
mitre_attack_id:
- T1574.002
- T1574
@@ -67,7 +67,7 @@ tags:
- Image
- ImageLoaded
- process_name
- Computer
- dest
- EventCode
- ProcessId
risk_score: 56
detections/endpoint/net_profiler_uac_bypass.yml
+2 -2
View File
@@ -33,13 +33,13 @@ tags:
confidence: 90
impact: 70
message: Suspicious modification of registry $registry_path$ with possible payload
path $registry_value_name$ in $dest$
path $registry_path$ and key $registry_key_name$ in $dest$
mitre_attack_id:
- T1548.002
- T1548
observable:
- name: dest
type: Hostname
type: Endpoint
role:
- Victim
product:
detections/endpoint/network_share_discovery_via_dir_command.yml
+3 -2
View File
@@ -15,6 +15,7 @@ description: The following analytic identifies object access on Windows administ
this behavior to try to infect other machines in the infected network.
search: '`wineventlog_security` EventCode=5140 ShareName IN("\\\\*\\ADMIN$","\\\\*\\C$","*\\\\*\\IPC$") AccessMask= 0x1
| stats min(_time) as firstTime max(_time) as lastTime count by ShareName IpAddress ObjectType SubjectUserName SubjectDomainName IpPort AccessMask Computer
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `network_share_discovery_via_dir_command_filter`'
@@ -35,11 +36,11 @@ tags:
confidence: 50
impact: 50
message: $user$ list executable files or directory in known sensitive SMB share. Share
name=$Share_Name$, Access mask=$Access_Mask$
name=$ShareName$, Access mask=$AccessMask$
mitre_attack_id:
- T1135
observable:
- name: Computer
- name: dest
type: Endpoint
role:
- Victim
detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
- RedLine Stealer
- FIN7
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 50
detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+2
View File
@@ -34,6 +34,8 @@ tags:
- AgentTesla
- RedLine Stealer
- FIN7
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 70
impact: 50
detections/endpoint/office_document_creating_schedule_task.yml
+1 -1
View File
@@ -57,7 +57,7 @@ tags:
required_fields:
- ImageLoaded
- AllImageLoaded
- Computer
- dest
- EventCode
- Image
- process_name
detections/endpoint/office_document_executing_macro_code.yml
+1 -1
View File
@@ -60,7 +60,7 @@ tags:
required_fields:
- ImageLoaded
- AllImageLoaded
- Computer
- dest
- EventCode
- Image
- process_name
detections/endpoint/powershell_4104_hunting.yml
+7 -15
View File
@@ -37,9 +37,10 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i
| eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) |
addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade,
mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi,
invokecmd, base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade,
invokecmd, base64, get | stats values(Score) by UserID, Computer, DoIt, enccom, compressed, downgrade,
iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi,
invokecmd, base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`'
invokecmd, base64, get, suspcmdlet, suspkeywrd | rename Computer as dest, UserID as user
| `powershell_4104_hunting_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
@@ -63,28 +64,19 @@ tags:
asset_type: Endpoint
confidence: 100
impact: 80
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $Computer$ by user $user$ executing suspicious commands.
message: Powershell was identified on endpoint $host$ by user $user$ executing suspicious commands.
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: UserID
- name: user
type: User
role:
- Victim
- name: Computer
type: Hostname
- name: dest
type: Endpoint
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
- AsyncRAT
- Data Destruction
- IcedID
- NjRAT
confidence: 80
impact: 70
message: A suspicious powershell script contains base64 command in $ScriptBlockText$
detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
+4 -2
View File
@@ -22,7 +22,9 @@ data_source:
- Powershell 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats
count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode
ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
ScriptBlockText | rename Computer as dest, UserID as user
| `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)`
| `powershell_get_localgroup_discovery_with_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -41,7 +43,7 @@ tags:
asset_type: Endpoint
confidence: 50
impact: 30
message: Local group discovery on $dest$ by $user$.
message: Local group discovery on endpoint $dest$ by user $user$.
mitre_attack_id:
- T1069
- T1069.001
detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+4 -4
View File
@@ -16,7 +16,7 @@ search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "p
TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
| stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress
Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
dest EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_remote_thread_to_known_windows_process_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, Create Remote thread from your endpoints. If you are
@@ -32,11 +32,11 @@ tags:
confidence: 90
impact: 70
message: A suspicious powershell process $process_name$ that tries to create a remote
thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$
thread on target process $TargetImage$ with eventcode $EventCode$ in host $dest$
mitre_attack_id:
- T1055
observable:
- name: Computer
- name: dest
type: Hostname
role:
- Victim
@@ -58,7 +58,7 @@ tags:
- TargetProcessId
- NewThreadId
- StartAddress
- Computer
- dest
- EventCode
risk_score: 63
security_domain: endpoint
detections/endpoint/process_deleting_its_process_file_path.yml
+15 -11
View File
@@ -14,15 +14,19 @@ data_source:
- Sysmon Event ID 1
search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image
= "*\\cmd.exe" | eval result = if(like(process,"%".parent_process."%"), "Found",
"Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by Computer
"Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by dest
user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result
| where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `process_deleting_its_process_file_path_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
The command-line arguments are mapped to the "process" field in the Endpoint data
model.
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
Additionally, you must ingest complete command-line executions. These logs must
be processed using the appropriate Splunk Technology Add-ons that are specific to
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: unknown
references:
- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
@@ -37,13 +41,13 @@ tags:
asset_type: Endpoint
confidence: 100
impact: 60
message: A process $Image$ tries to delete its process path in commandline $cmdline$
as part of defense evasion in host $Computer$
message: A process $Image$ tries to delete its process path in commandline $CommandLine$
as part of defense evasion in host $dest$ by user $user$
mitre_attack_id:
- T1070
observable:
- name: Computer
type: Hostname
- name: dest
type: Endpoint
role:
- Victim
- name: user
@@ -56,7 +60,7 @@ tags:
- Splunk Cloud
required_fields:
- EventCode
- Computer
- dest
- user
- ParentImage
- ParentCommandLine
detections/endpoint/ransomware_notes_bulk_creation.yml
+1 -1
View File
@@ -53,7 +53,7 @@ tags:
- file_name
- _time
- TargetFilename
- Computer
- dest
- Image
- user
risk_score: 81
detections/endpoint/registry_keys_used_for_persistence.yml
+1
View File
@@ -69,6 +69,7 @@ tags:
- Sneaky Active Directory Persistence Tricks
- BlackByte Ransomware
- Warzone RAT
- NjRAT
asset_type: Endpoint
confidence: 95
impact: 80
detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+3 -3
View File
@@ -21,8 +21,8 @@ search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe
(SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe
AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe
AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time)
as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage,
TargetProcessId, EventCode, GrantedAccess | rename Computer as dest | `security_content_ctime(firstTime)`|
as firstTime max(_time) as lastTime by dest, SourceImage, SourceProcessId, TargetImage,
TargetProcessId, EventCode, GrantedAccess | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
includes EventCode 10. This search uses an input macro named `sysmon`. We strongly
@@ -63,7 +63,7 @@ tags:
- EventCode
- TargetImage
- CallTrace
- Computer
- dest
- TargetProcessId
- SourceImage
- SourceProcessId
detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
+4 -4
View File
@@ -13,7 +13,7 @@ data_source:
- Sysmon Event ID 8
search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe"
| stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage
TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)`
TargetProcessId SourceProcessId StartAddress EventCode dest | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the SourceImage, TargetImage, and EventCode executions from your endpoints
@@ -30,11 +30,11 @@ tags:
confidence: 80
impact: 70
message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$
in host $Computer$
in host $dest$
mitre_attack_id:
- T1055
observable:
- name: Computer
- name: dest
type: Hostname
role:
- Victim
@@ -54,7 +54,7 @@ tags:
- SourceProcessId
- StartAddress
- EventCode
- Computer
- dest
risk_score: 56
security_domain: endpoint
tests:

Some files were not shown because too many files have changed in this diff Show More