From 1b26692ee2a2d9691e196166fc66926119929ccb Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 8 Aug 2023 14:54:08 +0200 Subject: [PATCH 01/89] converted detections to SPL2 --- .../domain/entities/detection.py | 1 + .../domain/entities/detection_tags.py | 2 + .../adapter/finding_report_writer.py | 46 ++++++++- .../adapter/obj_to_yml_adapter.py | 4 +- .../adapter/templates/finding_report.j2 | 50 +++++----- .../builder/backend_splunk_ba.py | 21 ++-- ...ssa___anomalous_usage_of_archive_tools.yml | 83 +++++++--------- .../srs/ssa___attempt_to_delete_services.yml | 53 +++++----- .../srs/ssa___attempt_to_disable_services.yml | 53 +++++----- ...dential_dump_from_registry_via_reg_exe.yml | 53 +++++----- ..._bcdedit_failure_recovery_modification.yml | 53 +++++----- ...ar_unallocated_sector_using_cipher_app.yml | 53 +++++----- dist/ssa/srs/ssa___delete_a_net_user.yml | 53 +++++----- ...___deny_permission_using_cacls_utility.yml | 53 +++++----- ...ohibited_applications_spawning_cmd_exe.yml | 53 +++++----- ...ssa___detect_rclone_command_line_usage.yml | 53 +++++----- .../srs/ssa___disable_net_user_account.yml | 53 +++++----- ...___dns_exfiltration_using_nslookup_app.yml | 53 +++++----- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 53 +++++----- ...__grant_permission_using_cacls_utility.yml | 53 +++++----- ..._files_and_directories_with_attrib_exe.yml | 53 +++++----- ...fy_acls_permission_of_files_or_folders.yml | 53 +++++----- ...e_product_spawning_windows_script_host.yml | 53 +++++----- .../srs/ssa___resize_shadowstorage_volume.yml | 53 +++++----- .../ssa___sdelete_application_execution.yml | 53 +++++----- ...ocess_running_from_unexpected_location.yml | 53 +++++----- .../ssa___wbadmin_delete_system_backups.yml | 53 +++++----- .../ssa___wevtutil_usage_to_clear_logs.yml | 53 +++++----- .../ssa___wevtutil_usage_to_disable_logs.yml | 53 +++++----- .../ssa___windows_bits_job_persistence.yml | 53 +++++----- .../ssa___windows_bitsadmin_download_file.yml | 53 +++++----- .../ssa___windows_certutil_decode_file.yml | 53 +++++----- ...a___windows_certutil_urlcache_download.yml | 53 +++++----- ...___windows_certutil_verifyctl_download.yml | 53 +++++----- ..._hijacking_inprocserver32_modification.yml | 53 +++++----- ...dows_curl_upload_to_remote_destination.yml | 53 +++++----- ...group_policy_object_modified_with_gpme.yml | 53 +++++----- ...ws_defender_tools_in_non_standard_path.yml | 53 +++++----- ...a___windows_diskshadow_proxy_execution.yml | 53 +++++----- ...ows_dotnet_binary_in_non_standard_path.yml | 53 +++++----- ...ndows_exchange_powershell_module_usage.yml | 53 +++++----- ...s_execute_arbitrary_commands_with_msdt.yml | 53 +++++----- ...ws_file_share_discovery_with_powerview.yml | 53 +++++----- .../ssa___windows_findstr_gpp_discovery.yml | 53 +++++----- ...s_ingress_tool_transfer_using_explorer.yml | 53 +++++----- ...ows_lolbin_binary_in_non_standard_path.yml | 53 +++++----- .../srs/ssa___windows_mshta_child_process.yml | 53 +++++----- .../ssa___windows_mshta_command_line_url.yml | 53 +++++----- ...a___windows_mshta_inline_hta_execution.yml | 53 +++++----- ...___windows_odbcconf_load_response_file.yml | 53 +++++----- ...tial_dumping_with_ntdsutil_export_ntds.yml | 53 +++++----- ...ws_os_credential_dumping_with_procdump.yml | 53 +++++----- ...connect_to_internet_with_hidden_window.yml | 53 +++++----- ...re_authentication_discovery_get_aduser.yml | 53 +++++----- ...uthentication_discovery_with_powerview.yml | 53 +++++----- .../ssa___windows_powershell_downloadfile.yml | 53 +++++----- ..._windows_powershell_start_bitstransfer.yml | 53 +++++----- ...sa___windows_powersploit_gpp_discovery.yml | 53 +++++----- .../ssa___windows_rasautou_dll_execution.yml | 53 +++++----- ...onsole_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...adplus_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...dvpack_dll_lolbas_in_non_standard_path.yml | 53 +++++----- ...ecutor_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...taller_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...appvlp_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...mpiler_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...ies_at_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...broker_exe_lolbas_in_non_standard_path.yml | 53 +++++----- ...__windows_rundll32_comsvcs_memory_dump.yml | 53 +++++----- ..._windows_rundll32_inline_hta_execution.yml | 53 +++++----- ...sa___windows_script_host_spawn_msbuild.yml | 53 +++++----- ...execution_compiled_html_file_decompile.yml | 53 +++++----- ...compiled_html_file_url_in_command_line.yml | 53 +++++----- ...l_file_using_infotech_storage_handlers.yml | 53 +++++----- ...xy_execution_msiexec_dllregisterserver.yml | 53 +++++----- ...roxy_execution_msiexec_remote_download.yml | 53 +++++----- ...proxy_execution_msiexec_unregister_dll.yml | 53 +++++----- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 53 +++++----- ...ssa___anomalous_usage_of_archive_tools.yml | 30 ++---- ...ssa___anomalous_usage_of_archive_tools.yml | 99 +++++++++++++++++++ 80 files changed, 2218 insertions(+), 1881 deletions(-) create mode 100644 tmp/ssa___anomalous_usage_of_archive_tools.yml diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 57d1c1a02a..23a3dcdf15 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -75,6 +75,7 @@ class Detection(BaseModel, SecurityContentObject): nes_fields: str = None providing_technologies: list = None runtime: str = None + internalVersion: str = None # @validator('name')v # def name_max_length(cls, v, values): diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 16490246e8..400db14246 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -40,7 +40,9 @@ class DetectionTags(BaseModel): risk_level: str = None observable_str: str = None evidence_str: str = None + analytics_story_str: str = None kill_chain_phases_id: list = None + kill_chain_phases_str: str = None research_site_url: str = None event_schema: str = None mappings: list = None diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index 44cea37840..6ca32f2d6a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -10,6 +10,38 @@ class FindingReportObject(): @staticmethod def writeFindingReport(detection : Detection) -> None: + if detection.tags.confidence < 33: + detection.tags.confidence_id = 1 + elif detection.tags.confidence < 66: + detection.tags.confidence_id = 2 + else: + detection.tags.confidence_id = 3 + + if detection.tags.impact < 20: + detection.tags.impact_id = 1 + elif detection.tags.impact < 40: + detection.tags.impact_id = 2 + elif detection.tags.impact < 60: + detection.tags.impact_id = 3 + elif detection.tags.impact < 80: + detection.tags.impact_id = 4 + else: + detection.tags.impact_id = 5 + + detection.tags.kill_chain_phases_id = dict() + for kill_chain_phase in detection.tags.kill_chain_phases: + detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase] + + kill_chain_phase_str = "[" + i = 0 + for kill_chain_phase in detection.tags.kill_chain_phases_id.keys(): + kill_chain_phase_str = '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" + if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1): + kill_chain_phase_str = kill_chain_phase_str + ', ' + else: + i = i + 1 + kill_chain_phase_str = kill_chain_phase_str + ']' + detection.tags.kill_chain_phases_str = kill_chain_phase_str if detection.tags.risk_score < 20: detection.tags.risk_level_id = 0 @@ -27,15 +59,23 @@ class FindingReportObject(): detection.tags.risk_level_id = 4 detection.tags.risk_level = "Critical" - evidence_str = "create_map(" + evidence_str = "[" for i in range(len(detection.tags.observable)): - evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_") + evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '": ' + detection.tags.observable[i]["name"].replace(".", "_") if not i == (len(detection.tags.observable) - 1): evidence_str = evidence_str + ', ' - evidence_str = evidence_str + ')' + evidence_str = evidence_str + ']' detection.tags.evidence_str = evidence_str + analytics_story_str = "[" + for i in range(len(detection.tags.analytic_story)): + analytics_story_str = analytics_story_str + '"' + detection.tags.analytic_story[i] + '"' + if not i == (len(detection.tags.analytic_story) - 1): + analytics_story_str = analytics_story_str + ', ' + analytics_story_str = analytics_story_str + ']' + detection.tags.analytics_story_str = analytics_story_str + if "actor.user.name" in detection.tags.required_fields: actor_user_name = "actor_user_name" else: diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 9fc187ce80..0b6b3ec063 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -66,7 +66,8 @@ class ObjToYmlAdapter(Adapter): "nist": obj.tags.nist } - obj.runtime = "SPL-DSP" + obj.runtime = "SPL2" + obj.internalVersion = 2 # remove unncessary fields YmlWriter.writeYmlFile(file_path, obj.dict( @@ -83,6 +84,7 @@ class ObjToYmlAdapter(Adapter): "known_false_positives": True, "references": True, "runtime": True, + "internalVersion": True, "tags": { #"analytic_story": True, diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index 80d533ffb9..f4b933f288 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -1,28 +1,30 @@ - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", {{ detection.tags.evidence_str }}, - "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", {{ actor_user_name }}, "."), - "users", [ - create_map( - "name", {{ actor_user_name }}, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", {{ detection.tags.risk_level_id }}, - "risk_score", {{ detection.tags.risk_score }}, - "severity_id", 0, - "rule", create_map("name", "{{ detection.name }}", "uid", "{{ detection.id }}", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = {{ detection.tags.evidence_str }}, + message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = {{ detection.tags.analytics_story_str }}, + class_name = "Detection Report", + confidence = {{ detection.tags.confidence }}, + confidence_id = {{ detection.tags.confidence_id }}, + duration = 0, + impact = {{ detection.tags.impact }}, + impact_id = {{ detection.tags.impact_id }}, + kill_chain = {{ detection.tags.kill_chain_phases_str }}, + nist = ["DE.AE"], + risk_level = "{{ detection.tags.risk_level }}", + category_uid = 2, + class_uid = 102001, + risk_level_id = {{ detection.tags.risk_level_id }}, + risk_score = {{ detection.tags.risk_score }}, + severity_id = 0, + rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events(); \ No newline at end of file + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index cc632c4668..f90a9277eb 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -88,32 +88,29 @@ class SplunkBABackend(TextQueryBackend): # fields_input_parsing = fields_input_parsing + ', ' detection_str = """ -| from read_ba_enriched_events() -| eval timestamp = ucast(map_get(input_event,"time"),"long", null) -| eval metadata = ucast(map_get(input_event, "metadata"),"map", null) -| eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) +$main = from source +| eval timestamp = time +| eval metadata_uid = metadata.uid """.replace("\n", " ") parsed_fields = [] for field in self.field_mapping["mapping"].keys(): mapped_field = self.field_mapping["mapping"][field] - parent = 'input_event' + parent = 'parent' i = 1 values = mapped_field.split('.') for val in values: - if parent == "input_event": - new_val = val + if parent == "parent": + parent = val + continue else: new_val = parent + '_' + val if new_val in parsed_fields: parent = new_val i = i + 1 continue - if i == len(values): - parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "string", null) ' - else: - parser_str = '| eval ' + new_val + '' + '=ucast(map_get(' + parent + ',"' + val + '"), "map", null) ' + parser_str = '| eval ' + new_val + ' = ' + parent + '.' + val + ' ' detection_str = detection_str + parser_str parsed_fields.append(new_val) parent = new_val @@ -121,8 +118,6 @@ class SplunkBABackend(TextQueryBackend): detection_str = detection_str + "| where " + query detection_str = detection_str.replace("\\\\\\\\", "\\\\") - - return detection_str def finalize_output_data_model(self, queries: List[str]) -> List[str]: diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 89a9d006aa..3a684bb988 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -3,53 +3,45 @@ id: 63614a58-10e2-4c6c-ae81-ea1113681439 version: 1 description: The following detection identifies the usage of archive tools from the command line. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") - OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") - OR like(actor_process_file_name, "%cmd.exe")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 42, - "severity_id", 0, - "rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" + OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, + "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Anomalous usage of Archive Tools has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Cobalt Strike", "NOBELIUM Group", "Insider Threat"], + class_name = "Detection Report", + confidence = 60, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 42, + severity_id = 0, + rule = {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -114,4 +106,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index a67dfcb554..2159ac7a1d 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 36, - "severity_id", 0, - "rule", create_map("name", "Attempt To Delete Services", "uid", "a0c8c292-d01a-11eb-aa18-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Attempt To Delete Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 60, + confidence_id = 2, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 36, + severity_id = 0, + rule = {"name": "Attempt To Delete Services", "uid": "a0c8c292-d01a-11eb-aa18-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -120,4 +122,5 @@ test: - file_name: sc_del.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 0babd2c2c8..5239896158 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND process_file_name="sc.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 36, - "severity_id", 0, - "rule", create_map("name", "Attempt To Disable Services", "uid", "afb31de4-d023-11eb-98d5-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Attempt To Disable Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 60, + confidence_id = 2, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 36, + severity_id = 0, + rule = {"name": "Attempt To Disable Services", "uid": "afb31de4-d023-11eb-98d5-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -117,4 +119,5 @@ test: - file_name: sc_disable.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index ddc458e504..18c10e792f 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "Attempted Credential Dump From Registry via Reg exe", "uid", "14038953-e5f2-4daf-acff-5452062baf03", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Attempted Credential Dump From Registry via Reg exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "Attempted Credential Dump From Registry via Reg exe", "uid": "14038953-e5f2-4daf-acff-5452062baf03", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -117,4 +119,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 572eba26b4..7b4e45184b 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line, "%recoveryenabled%")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "BCDEdit Failure Recovery Modification", "uid", "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "BCDEdit Failure Recovery Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ryuk Ransomware", "Ransomware", "Information Sabotage"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "BCDEdit Failure Recovery Modification", "uid": "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -112,4 +114,5 @@ test: - file_name: windows-security_bcdedit_wbadmin.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 0769a93a6c..87ca93870b 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Clear Unallocated Sector Using Cipher App", "uid", "8f907d90-6173-11ec-9c23-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Clear Unallocated Sector Using Cipher App has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ransomware", "Information Sabotage"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Clear Unallocated Sector Using Cipher App", "uid": "8f907d90-6173-11ec-9c23-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -113,4 +115,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.004/cipher/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 0b3d0bf55f..3db8d162e4 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe" OR process_file_name="net1.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Delete A Net User", "uid", "8776d79c-d26e-11eb-9a56-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Delete A Net User has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Delete A Net User", "uid": "8776d79c-d26e-11eb-9a56-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index f90ed068db..95a83546b1 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Deny Permission using Cacls Utility", "uid", "b76eae28-cd25-11eb-9c92-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Deny Permission using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Information Sabotage"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Deny Permission using Cacls Utility", "uid": "b76eae28-cd25-11eb-9c92-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -115,4 +117,5 @@ test: - file_name: all_icalc.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 66f8616fc8..5af0ae8dbb 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -30,33 +30,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Detect Prohibited Applications Spawning cmd exe", "uid", "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Detect Prohibited Applications Spawning cmd exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Command-Line Executions", "Insider Threat"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Installation", "phase_id": 5}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Detect Prohibited Applications Spawning cmd exe", "uid": "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. @@ -119,4 +121,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index c1862cc5bb..a984fc0c74 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -32,33 +32,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Detect RClone Command-Line Usage", "uid", "e8b74268-5454-11ec-a799-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Detect RClone Command-Line Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["DarkSide Ransomware", "Ransomware", "Insider Threat"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Detect RClone Command-Line Usage", "uid": "e8b74268-5454-11ec-a799-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -125,4 +127,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index a96f5a9195..1927f56abb 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND (process_file_name="net.exe" OR process_file_name="net1.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Disable Net User Account", "uid", "ba858b08-d26c-11eb-af9b-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Disable Net User Account has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Ransomware"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Installation", "phase_id": 5}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Disable Net User Account", "uid": "ba858b08-d26c-11eb-af9b-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: net_user_dis.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index e02d07c982..a4d7157c44 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%")) AND process_file_name="nslookup.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 72, - "severity_id", 0, - "rule", create_map("name", "DNS Exfiltration Using Nslookup App", "uid", "2452e632-9e0d-11eb-34ba-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "DNS Exfiltration Using Nslookup App has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command And Control"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 72, + severity_id = 0, + rule = {"name": "DNS Exfiltration Using Nslookup App", "uid": "2452e632-9e0d-11eb-34ba-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -120,4 +122,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index f50eaf9a35..3c91c5df52 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 54, - "severity_id", 0, - "rule", create_map("name", "Fsutil Zeroing File", "uid", "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Fsutil Zeroing File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ransomware", "Insider Threat", "Information Sabotage"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 54, + severity_id = 0, + rule = {"name": "Fsutil Zeroing File", "uid": "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -115,4 +117,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index fc32e7bda4..f3dddb5a82 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Grant Permission Using Cacls Utility", "uid", "c6da561a-cd29-11eb-ae65-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Grant Permission Using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig", "Insider Threat"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Grant Permission Using Cacls Utility", "uid": "c6da561a-cd29-11eb-ae65-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -115,4 +117,5 @@ test: - file_name: all_icalc.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 44ab76c288..4ee4d7edb4 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 72, - "severity_id", 0, - "rule", create_map("name", "Hiding Files And Directories With Attrib exe", "uid", "028e4406-6176-11ec-aec2-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Hiding Files And Directories With Attrib exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques", "Information Sabotage", "Insider Threat"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 72, + severity_id = 0, + rule = {"name": "Hiding Files And Directories With Attrib exe", "uid": "028e4406-6176-11ec-aec2-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -118,4 +120,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/attrib_hidden/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index abc8311a20..9f81fa8016 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Modify ACLs Permission Of Files Or Folders", "uid", "9ae9a48a-cdbe-11eb-875a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Modify ACLs Permission Of Files Or Folders has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["XMRig"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Modify ACLs Permission Of Files Or Folders", "uid": "9ae9a48a-cdbe-11eb-875a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -117,4 +119,5 @@ test: - file_name: all_icalc.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 2cbbcefe1b..43c1b36b33 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "Office Product Spawning Windows Script Host", "uid", "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Office Product Spawning Windows Script Host has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Spearphishing Attachments"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Delivery", "phase_id": 3}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "Office Product Spawning Windows Script Host", "uid": "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -116,4 +118,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 3e2d5a8bb6..7960274bc8 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 64, - "severity_id", 0, - "rule", create_map("name", "Resize Shadowstorage Volume", "uid", "dbc30554-d27e-11eb-9e5e-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Resize Shadowstorage Volume has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Clop Ransomware", "Ransomware"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 64, + severity_id = 0, + rule = {"name": "Resize Shadowstorage Volume", "uid": "dbc30554-d27e-11eb-9e5e-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -116,4 +118,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index aa26c33862..4515d16cc1 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -35,33 +35,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name, "%sdelete%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 42, - "severity_id", 0, - "rule", create_map("name", "Sdelete Application Execution", "uid", "fcc52b9a-4616-11ec-8454-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Sdelete Application Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Information Sabotage", "Insider Threat"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 42, + severity_id = 0, + rule = {"name": "Sdelete Application Execution", "uid": "fcc52b9a-4616-11ec-8454-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -129,4 +131,5 @@ test: - file_name: security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 5c322f21b6..6a965d3a5e 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -236,33 +236,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match_regex(process_file_path, /(?i)\\windows\\system32/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "System Process Running from Unexpected Location", "uid", "28179107-099a-464a-94d3-08301e6c055f", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "System Process Running from Unexpected Location has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Defense Evasion Tactics", "Masquerading - Rename System Utilities"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "System Process Running from Unexpected Location", "uid": "28179107-099a-464a-94d3-08301e6c055f", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] @@ -321,4 +323,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 1a22c44bfb..0cf240058f 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 15, - "severity_id", 0, - "rule", create_map("name", "WBAdmin Delete System Backups", "uid", "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "WBAdmin Delete System Backups has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ryuk Ransomware", "Ransomware"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 30, + impact_id = 2, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 15, + severity_id = 0, + rule = {"name": "WBAdmin Delete System Backups", "uid": "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -114,4 +116,5 @@ test: - file_name: windows-security_bcdedit_wbadmin.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index a74aa387f6..10e487c32c 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "WevtUtil Usage To Clear Logs", "uid", "5438113c-cdd9-11eb-93b8-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "WevtUtil Usage To Clear Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware", "Insider Threat", "CISA AA22-264A"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "WevtUtil Usage To Clear Logs", "uid": "5438113c-cdd9-11eb-93b8-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -121,4 +123,5 @@ test: - file_name: clear_evt.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 423c110ccc..727e84a790 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 63, - "severity_id", 0, - "rule", create_map("name", "Wevtutil Usage To Disable Logs", "uid", "a4bdc944-cdd9-11eb-ac97-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Wevtutil Usage To Disable Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Log Manipulation", "Ransomware", "Insider Threat", "Information Sabotage"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 63, + severity_id = 0, + rule = {"name": "Wevtutil Usage To Disable Logs", "uid": "a4bdc944-cdd9-11eb-ac97-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -117,4 +119,5 @@ test: - file_name: disable_evt.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index d810c3e4e5..424d82b72e 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -29,33 +29,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Bits Job Persistence", "uid", "1e25e97a-8ea4-11ec-9767-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Bits Job Persistence has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["BITS Jobs", "Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Installation", "phase_id": 5}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Bits Job Persistence", "uid": "1e25e97a-8ea4-11ec-9767-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -125,4 +127,5 @@ test: - file_name: bits-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 8ef9fa0746..5bac17445c 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -32,33 +32,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows Bitsadmin Download File", "uid", "d76e8188-8f5a-11ec-ace4-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Bitsadmin Download File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows Bitsadmin Download File", "uid": "d76e8188-8f5a-11ec-ace4-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -131,4 +133,5 @@ test: - file_name: bits-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/bits-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67fd722158..e097a6d227 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows CertUtil Decode File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 40, - "severity_id", 0, - "rule", create_map("name", "Windows CertUtil Decode File", "uid", "b06983f4-8f72-11ec-ab50-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows CertUtil Decode File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Deobfuscate-Decode Files or Information", "Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 40, + severity_id = 0, + rule = {"name": "Windows CertUtil Decode File", "uid": "b06983f4-8f72-11ec-ab50-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -123,4 +125,5 @@ test: - file_name: encode-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/encode-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index fd8dacebe4..d1ea845f14 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows CertUtil URLCache Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows CertUtil URLCache Download", "uid", "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows CertUtil URLCache Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows CertUtil URLCache Download", "uid": "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -120,4 +122,5 @@ test: - file_name: T1105-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 9c70a807aa..9fd275acd2 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows CertUtil VerifyCtl Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows CertUtil VerifyCtl Download", "uid", "9ac29c40-8f6b-11ec-b19a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows CertUtil VerifyCtl Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows CertUtil VerifyCtl Download", "uid": "9ac29c40-8f6b-11ec-b19a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -121,4 +123,5 @@ test: - file_name: T1105-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index b3669571d7..450f7a3765 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows COM Hijacking InprocServer32 Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 64, - "severity_id", 0, - "rule", create_map("name", "Windows COM Hijacking InprocServer32 Modification", "uid", "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows COM Hijacking InprocServer32 Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 64, + severity_id = 0, + rule = {"name": "Windows COM Hijacking InprocServer32 Modification", "uid": "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -120,4 +122,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 744e04b56e..90a4187b19 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -40,33 +40,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Curl Upload to Remote Destination has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows Curl Upload to Remote Destination", "uid", "cc8d046a-543b-11ec-b864-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Curl Upload to Remote Destination has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Ingress Tool Transfer", "Insider Threat"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows Curl Upload to Remote Destination", "uid": "cc8d046a-543b-11ec-b864-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -131,4 +133,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml index a5e83f1ed2..7bb458684e 100644 --- a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where (process_file_name="mmc.exe" AND like(process_cmd_line, "%gpme.msc%")) OR like(process_cmd_line, "%31B2F340-016D-11D2-945F-00C04FB984F9%") OR like(process_cmd_line, "%6AC1786C-016F-11D2-945F-00C04fB984F9%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Default Group Policy Object Modified with GPME has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 50, - "severity_id", 0, - "rule", create_map("name", "Windows Default Group Policy Object Modified with GPME", "uid", "bcb55c13-067b-4648-98f3-627010f72520", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Default Group Policy Object Modified with GPME has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 50, + severity_id = 0, + rule = {"name": "Windows Default Group Policy Object Modified with GPME", "uid": "bcb55c13-067b-4648-98f3-627010f72520", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -125,4 +127,5 @@ test: - file_name: security-4688.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/security-4688.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 0c999d0876..489ccac64b 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Defender Tools in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Defender Tools in Non Standard Path", "uid", "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Defender Tools in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Defender Tools in Non Standard Path", "uid": "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. references: @@ -110,4 +112,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index ef37944b3c..dcc76e0bb4 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) AND process_file_name="diskshadow.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Diskshadow Proxy Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows Diskshadow Proxy Execution", "uid", "aa502688-9037-11ec-842d-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Diskshadow Proxy Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows Diskshadow Proxy Execution", "uid": "aa502688-9037-11ec-842d-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -114,4 +116,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index 86312ce4bd..804e09936c 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -58,33 +58,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path, /(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows DotNet Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows DotNet Binary in Non Standard Path", "uid", "21179107-099a-324a-94d3-08301e6c065f", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows DotNet Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows DotNet Binary in Non Standard Path", "uid": "21179107-099a-324a-94d3-08301e6c065f", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application @@ -155,4 +157,5 @@ test: - file_name: dotnet_lolbin-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 3f20f3aaf5..512dd474b8 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -37,33 +37,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows Exchange PowerShell Module Usage has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 32, - "severity_id", 0, - "rule", create_map("name", "Windows Exchange PowerShell Module Usage", "uid", "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["ProxyShell", "CISA AA22-264A"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 40, + impact_id = 3, + kill_chain = {"phase": "Installation", "phase_id": 5}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 32, + severity_id = 0, + rule = {"name": "Windows Exchange PowerShell Module Usage", "uid": "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -123,4 +125,5 @@ test: - file_name: windows-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index c1f2034cd3..bc4dec7946 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -29,33 +29,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Execute Arbitrary Commands with MSDT has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 100, - "severity_id", 0, - "rule", create_map("name", "Windows Execute Arbitrary Commands with MSDT", "uid", "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Execute Arbitrary Commands with MSDT has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 100, + severity_id = 0, + rule = {"name": "Windows Execute Arbitrary Commands with MSDT", "uid": "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -123,4 +125,5 @@ test: - file_name: msdt-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index 7210a61325..da89d537c3 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -20,33 +20,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows File Share Discovery With Powerview has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 48, - "severity_id", 0, - "rule", create_map("name", "Windows File Share Discovery With Powerview", "uid", "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 48, + severity_id = 0, + rule = {"name": "Windows File Share Discovery With Powerview", "uid": "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -98,4 +100,5 @@ test: - file_name: windows-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml index a0c8df7164..68327e6f3a 100644 --- a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="findstr.exe" AND like(process_cmd_line, "%cpassword%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Findstr GPP Discovery has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Findstr GPP Discovery", "uid", "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Findstr GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Findstr GPP Discovery", "uid": "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -122,4 +124,5 @@ test: - file_name: windows-4688.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-4688.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index caca8f71f3..de392f8484 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -28,33 +28,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="explorer.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Ingress Tool Transfer Using Explorer has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 25, - "severity_id", 0, - "rule", create_map("name", "Windows Ingress Tool Transfer Using Explorer", "uid", "695bfad6-9662-4f9e-a576-bf02a951aa60", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Ingress Tool Transfer Using Explorer has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["DarkCrystal RAT"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Command And Control", "phase_id": 6}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 25, + severity_id = 0, + rule = {"name": "Windows Ingress Tool Transfer Using Explorer", "uid": "695bfad6-9662-4f9e-a576-bf02a951aa60", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints. @@ -116,4 +118,5 @@ test: - file_name: T1105_explorer-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index 4939a389eb..b5d059520e 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -57,33 +57,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path, /(?i)(?i)\\microsoft.net/)=true)) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows LOLBin Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows LOLBin Binary in Non Standard Path", "uid", "25689101-012a-324a-94d3-08301e6c065a", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows LOLBin Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Ransomware", "WhisperGate"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows LOLBin Binary in Non Standard Path", "uid": "25689101-012a-324a-94d3-08301e6c065a", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application @@ -152,4 +154,5 @@ test: - file_name: dotnet_lolbin-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 04027d661a..7ac7e452bd 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows MSHTA Child Process has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows MSHTA Child Process", "uid", "f63f7e9c-9526-11ec-9fc7-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows MSHTA Child Process has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows MSHTA Child Process", "uid": "f63f7e9c-9526-11ec-9fc7-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 88c567faca..49fb0fa644 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="mshta.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows MSHTA Command-Line URL has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows MSHTA Command-Line URL", "uid", "9b35c538-94ef-11ec-9439-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows MSHTA Command-Line URL has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows MSHTA Command-Line URL", "uid": "9b35c538-94ef-11ec-9439-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -121,4 +123,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index bfe0659b88..a9ad8f960c 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows MSHTA Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows MSHTA Inline HTA Execution", "uid", "24962154-9524-11ec-9333-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows MSHTA Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows MSHTA Inline HTA Execution", "uid": "24962154-9524-11ec-9333-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -119,4 +121,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index 060d41f55b..7d9bc65547 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Odbcconf Load Response File has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 42, - "severity_id", 0, - "rule", create_map("name", "Windows Odbcconf Load Response File", "uid", "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Odbcconf Load Response File has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 42, + severity_id = 0, + rule = {"name": "Windows Odbcconf Load Response File", "uid": "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -116,4 +118,5 @@ test: - file_name: odbcconf-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index c46df3acbb..5c68d82120 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") AND like(process_cmd_line, "%ntds%")) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 50, - "severity_id", 0, - "rule", create_map("name", "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid", "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 50, + severity_id = 0, + rule = {"name": "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid": "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -126,4 +128,5 @@ test: - file_name: 4688_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index 82ac46545c..fc19621d48 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) AND like(process_cmd_line, "%lsass%") - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows OS Credential Dumping with Procdump has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows OS Credential Dumping with Procdump", "uid", "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows OS Credential Dumping with Procdump has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping", "HAFNIUM Group"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows OS Credential Dumping with Procdump", "uid": "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -124,4 +126,5 @@ test: - file_name: procdump_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index afa33b2910..1ca8b9f350 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Powershell Connect to Internet With Hidden Window has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows Powershell Connect to Internet With Hidden Window", "uid", "477e068e-8b6d-11ec-b6c1-81af21670352", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Powershell Connect to Internet With Hidden Window has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group", "Log4Shell CVE-2021-44228"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows Powershell Connect to Internet With Hidden Window", "uid": "477e068e-8b6d-11ec-b6c1-81af21670352", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -128,4 +130,5 @@ test: - file_name: hidden_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/hidden_windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 736e0b05da..97b0b8d5a8 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -21,33 +21,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 54, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid", "d57b4d91-fc91-4482-a325-47693cced1eb", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Kerberos Attacks"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 54, + severity_id = 0, + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid": "d57b4d91-fc91-4482-a325-47693cced1eb", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -101,4 +103,5 @@ test: - file_name: windows-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log source: WinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index d7f5a99b1e..ac4fe75665 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -22,33 +22,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 54, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid", "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Kerberos Attacks"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 60, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 54, + severity_id = 0, + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid": "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -101,4 +103,5 @@ test: - file_name: getdomainuser.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 4b899f2c9b..0dd6e17262 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Powershell DownloadFile has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows Powershell DownloadFile", "uid", "46440222-81d5-44b1-a376-19dcd70d1b08", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Powershell DownloadFile has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Malicious PowerShell", "Ingress Tool Transfer", "Log4Shell CVE-2021-44228"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 50, + impact_id = 3, + kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows Powershell DownloadFile", "uid": "46440222-81d5-44b1-a376-19dcd70d1b08", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -122,4 +124,5 @@ test: - file_name: downloadfile_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index 176bfc055a..ff7265f85f 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -29,33 +29,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows PowerShell Start-BitsTransfer has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 49, - "severity_id", 0, - "rule", create_map("name", "Windows PowerShell Start-BitsTransfer", "uid", "0bafd086-8f61-11ec-996e-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows PowerShell Start-BitsTransfer has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["BITS Jobs", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 49, + severity_id = 0, + rule = {"name": "Windows PowerShell Start-BitsTransfer", "uid": "0bafd086-8f61-11ec-996e-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -123,4 +125,5 @@ test: - file_name: T1197_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/T1197_windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index 71ca37b2d3..dbe9c8378b 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -22,33 +22,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), - "message", concat("Windows PowerSploit GPP Discovery has been triggered on ", device_hostname, " by ", "Unknown", "."), - "users", [ - create_map( - "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows PowerSploit GPP Discovery", "uid", "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Active Directory Privilege Escalation"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows PowerSploit GPP Discovery", "uid": "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -103,4 +105,5 @@ test: - file_name: win-powershell.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 21cca3f8fc..d98473c520 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rasautou DLL Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows Rasautou DLL Execution", "uid", "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rasautou DLL Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows Defense Evasion Tactics", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows Rasautou DLL Execution", "uid": "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -120,4 +122,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 16da05f0aa..02be4d7a2d 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid", "c842931e-661f-42bc-a4df-0460d93cfb69", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid": "c842931e-661f-42bc-a4df-0460d93cfb69", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -120,4 +122,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 5bce274dce..28e61dd101 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid", "ecaaf956-c516-4980-b08e-8c01c19614ca", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid": "ecaaf956-c516-4980-b08e-8c01c19614ca", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index ecd69422fa..762064a016 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid", "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid": "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 8d5b573a57..07b2812db5 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid", "e124f71f-11bc-47e4-9931-6046d256005d", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid": "e124f71f-11bc-47e4-9931-6046d256005d", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -119,4 +121,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 3f93be3ac8..2c4ff2a9d6 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -25,33 +25,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid", "057c06c7-ef31-4749-b5c9-199152e53a06", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid": "057c06c7-ef31-4749-b5c9-199152e53a06", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -120,4 +122,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 7b0d5af043..becd6f4593 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid", "93862a89-abe0-4094-909a-08ec390aa5e3", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid": "93862a89-abe0-4094-909a-08ec390aa5e3", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index f42875000d..047637fd7f 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid", "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid": "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -119,4 +121,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index ebd4dbec13..49b729c8db 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid", "6401d583-0052-4dc5-a713-68b510826d2b", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid": "6401d583-0052-4dc5-a713-68b510826d2b", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -117,4 +119,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 857dc390ee..8bdd3ecf0d 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -24,33 +24,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 0, - "risk_score", 14, - "severity_id", 0, - "rule", create_map("name", "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid", "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Unusual Processes", "Living Off The Land"], + class_name = "Detection Report", + confidence = 70, + confidence_id = 3, + duration = 0, + impact = 20, + impact_id = 2, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Info", + category_uid = 2, + class_uid = 102001, + risk_level_id = 0, + risk_score = 14, + severity_id = 0, + rule = {"name": "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid": "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -118,4 +120,5 @@ test: - file_name: lolbas_dataset.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index 1a2d458cc2..8b1e1aa91a 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rundll32 Comsvcs Memory Dump has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 40, - "severity_id", 0, - "rule", create_map("name", "Windows Rundll32 Comsvcs Memory Dump", "uid", "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rundll32 Comsvcs Memory Dump has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Credential Dumping", "Suspicious Rundll32 Activity"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 40, + impact_id = 3, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 40, + severity_id = 0, + rule = {"name": "Windows Rundll32 Comsvcs Memory Dump", "uid": "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) @@ -114,4 +116,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index ab4d55d262..3e53f68714 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Rundll32 Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 2, - "risk_score", 56, - "severity_id", 0, - "rule", create_map("name", "Windows Rundll32 Inline HTA Execution", "uid", "0caa1dd6-94f5-11ec-9786-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Rundll32 Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious MSHTA Activity", "NOBELIUM Group", "Living Off The Land"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Medium", + category_uid = 2, + class_uid = 102001, + risk_level_id = 2, + risk_score = 56, + severity_id = 0, + rule = {"name": "Windows Rundll32 Inline HTA Execution", "uid": "0caa1dd6-94f5-11ec-9786-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -122,4 +124,5 @@ test: - file_name: windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 1024255a57..0978d59113 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows Script Host Spawn MSBuild has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows Script Host Spawn MSBuild", "uid", "92886f1c-9b11-11ec-848a-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows Script Host Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows Script Host Spawn MSBuild", "uid": "92886f1c-9b11-11ec-848a-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -120,4 +122,5 @@ test: - file_name: msbuild-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 1a299b5c7c..bda0531cee 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -26,33 +26,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid", "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Compiled HTML Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 100, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid": "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -119,4 +121,5 @@ test: - file_name: 4688_windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 51024955d7..27c927747e 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -31,33 +31,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="hh.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 90, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid", "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Compiled HTML Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 90, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 90, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid": "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -129,4 +131,5 @@ test: - file_name: chm-wineventlog-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index f2a788c237..93e3899975 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -34,33 +34,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, "%its:%")) AND process_file_name="hh.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 3, - "risk_score", 72, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid", "ba0c2450-caea-4086-ac3a-a71e2659754b", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Compiled HTML Activity", "Living Off The Land"], + class_name = "Detection Report", + confidence = 90, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 72, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid": "ba0c2450-caea-4086-ac3a-a71e2659754b", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -132,4 +134,5 @@ test: - file_name: chm-wineventlog-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 473f111800..dd369547a9 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) AND process_file_name="msiexec.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid", "8d1d5570-722c-49a3-996c-2e2cceef5163", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows System Binary Proxy Execution MSIExec"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid": "8d1d5570-722c-49a3-996c-2e2cceef5163", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -113,4 +115,5 @@ test: - file_name: 4688_msiexec-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 0b7212880c..03042eac29 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND process_file_name="msiexec.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution MSIExec Remote Download", "uid", "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows System Binary Proxy Execution MSIExec"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution MSIExec Remote Download", "uid": "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -113,4 +115,5 @@ test: - file_name: 4688_msiexec-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index f51b95cf5a..3b36e5418d 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -23,33 +23,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) AND process_file_name="msiexec.exe" - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 1, - "risk_score", 35, - "severity_id", 0, - "rule", create_map("name", "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid", "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Windows System Binary Proxy Execution MSIExec"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid": "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -113,4 +115,5 @@ test: - file_name: 4688_msiexec-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log source: XmlWinEventLog -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 701db02b7c..94d2f62ab3 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -27,33 +27,35 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true - | eval body=create_map( - "devices", [ - create_map( - "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) - ) - ], - "time", timestamp, - "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), - "message", concat("Windows WMIPrvse Spawn MSBuild has been triggered on ", device_hostname, " by ", actor_user_name, "."), - "users", [ - create_map( - "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) - ) - ], - "activity_id", 1, - "category_uid", 2, - "class_uid", 102001, - "risk_level_id", 4, - "risk_score", 80, - "severity_id", 0, - "rule", create_map("name", "Windows WMIPrvse Spawn MSBuild", "uid", "76b3b290-9b31-11ec-a934-acde48001122", "type", "Streaming"), - "metadata", create_map("customer_uid", ucast(map_get(metadata,"customer_uid"), "string", null), "product", create_map("name", "Behavior Analytics", "vendor_name", "Splunk"), "version", "1.0.0-rc.2", "logged_time", time()), + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + message = "Windows WMIPrvse Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"], + class_name = "Detection Report", + confidence = 100, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = {"phase": "Exploitation", "phase_id": 4}], + nist = ["DE.AE"], + risk_level = "Critical", + category_uid = 2, + class_uid = 102001, + risk_level_id = 4, + risk_score = 80, + severity_id = 0, + rule = {"name": "Windows WMIPrvse Spawn MSBuild", "uid": "76b3b290-9b31-11ec-a934-acde48001122", "type": "Streaming"), + metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, "type_uid", 10200101, "start_time", timestamp, "end_time", timestamp - ) - | into write_ba_finding_events();' + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -120,4 +122,5 @@ test: - file_name: msbuild-windows-security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/msbuild-windows-security.log source: WinEventLog:Security -runtime: SPL-DSP +runtime: SPL2 +internalVersion: 2 diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 7bda2abc32..b5b2ebfeda 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -9,26 +9,16 @@ description: The following detection identifies the usage of archive tools from command line. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") - OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") - OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" + OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, + "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/tmp/ssa___anomalous_usage_of_archive_tools.yml b/tmp/ssa___anomalous_usage_of_archive_tools.yml new file mode 100644 index 0000000000..8a7dd6cc0c --- /dev/null +++ b/tmp/ssa___anomalous_usage_of_archive_tools.yml @@ -0,0 +1,99 @@ +name: Anomalous usage of Archive Tools +id: 63614a58-10e2-4c6c-ae81-ea1113681439 +version: 1 +date: '2021-11-22' +author: Patrick Bareiss, Splunk +type: Anomaly +status: production +description: The following detection identifies the usage of archive tools from the + command line. +data_source: +- Windows Security 4688 +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name IN ("WinRAR.exe", + "7z%", "winzip%")) AND (actor_process_file_name IN ("%powershell.exe", "%cmd.exe")) + --finding_report--' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives can be ligitmate usage of archive tools from + the command line. +references: +- https://attack.mitre.org/techniques/T1560/001/ +tags: + analytic_story: + - Cobalt Strike + - NOBELIUM Group + - Insider Threat + asset_type: Endpoint + confidence: 60 + impact: 70 + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading + of 7zip. + mitre_attack_id: + - T1560.001 + - T1560 + observable: + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File + - name: process.cmd_line + type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 42 + security_domain: endpoint + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log + source: WinEventLog:Security From 9533c55d933e6c1fbecfd575d686b7175bfa81b9 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 8 Aug 2023 16:00:23 +0200 Subject: [PATCH 02/89] converted detections to SPL2 --- .../contentctl_infrastructure/adapter/finding_report_writer.py | 2 +- dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml | 2 +- dist/ssa/srs/ssa___attempt_to_delete_services.yml | 2 +- dist/ssa/srs/ssa___attempt_to_disable_services.yml | 2 +- ...sa___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml | 2 +- .../ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml | 2 +- dist/ssa/srs/ssa___delete_a_net_user.yml | 2 +- dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml | 2 +- .../ssa___detect_prohibited_applications_spawning_cmd_exe.yml | 2 +- dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml | 2 +- dist/ssa/srs/ssa___disable_net_user_account.yml | 2 +- dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml | 2 +- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 2 +- dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml | 2 +- .../srs/ssa___hiding_files_and_directories_with_attrib_exe.yml | 2 +- .../srs/ssa___modify_acls_permission_of_files_or_folders.yml | 2 +- .../srs/ssa___office_product_spawning_windows_script_host.yml | 2 +- dist/ssa/srs/ssa___resize_shadowstorage_volume.yml | 2 +- dist/ssa/srs/ssa___sdelete_application_execution.yml | 2 +- .../ssa___system_process_running_from_unexpected_location.yml | 2 +- dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml | 2 +- dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml | 2 +- dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml | 2 +- dist/ssa/srs/ssa___windows_bits_job_persistence.yml | 2 +- dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_decode_file.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml | 2 +- dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml | 2 +- .../ssa___windows_com_hijacking_inprocserver32_modification.yml | 2 +- .../ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml | 2 +- ...__windows_default_group_policy_object_modified_with_gpme.yml | 2 +- .../srs/ssa___windows_defender_tools_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml | 2 +- .../srs/ssa___windows_dotnet_binary_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml | 2 +- .../srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml | 2 +- .../srs/ssa___windows_file_share_discovery_with_powerview.yml | 2 +- dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml | 2 +- .../srs/ssa___windows_ingress_tool_transfer_using_explorer.yml | 2 +- .../srs/ssa___windows_lolbin_binary_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_child_process.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_command_line_url.yml | 2 +- dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml | 2 +- dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml | 2 +- ..._windows_os_credential_dumping_with_ntdsutil_export_ntds.yml | 2 +- .../srs/ssa___windows_os_credential_dumping_with_procdump.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...isabled_kerberos_pre_authentication_discovery_get_aduser.yml | 2 +- ...led_kerberos_pre_authentication_discovery_with_powerview.yml | 2 +- dist/ssa/srs/ssa___windows_powershell_downloadfile.yml | 2 +- dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml | 2 +- dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml | 2 +- dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml | 2 +- ...tilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml | 2 +- ..._system_utilities_adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...system_utilities_advpack_dll_lolbas_in_non_standard_path.yml | 2 +- ..._utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...m_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml | 2 +- ..._system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...tilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...name_system_utilities_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...ystem_utilities_atbroker_exe_lolbas_in_non_standard_path.yml | 2 +- dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml | 2 +- dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml | 2 +- dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml | 2 +- ...stem_binary_proxy_execution_compiled_html_file_decompile.yml | 2 +- ...y_proxy_execution_compiled_html_file_url_in_command_line.yml | 2 +- ...ution_compiled_html_file_using_infotech_storage_handlers.yml | 2 +- ..._system_binary_proxy_execution_msiexec_dllregisterserver.yml | 2 +- ...ws_system_binary_proxy_execution_msiexec_remote_download.yml | 2 +- ...ows_system_binary_proxy_execution_msiexec_unregister_dll.yml | 2 +- dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- 73 files changed, 73 insertions(+), 73 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index 6ca32f2d6a..6eb4892445 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -35,7 +35,7 @@ class FindingReportObject(): kill_chain_phase_str = "[" i = 0 for kill_chain_phase in detection.tags.kill_chain_phases_id.keys(): - kill_chain_phase_str = '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" + kill_chain_phase_str = kill_chain_phase_str + '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1): kill_chain_phase_str = kill_chain_phase_str + ', ' else: diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 3a684bb988..4c102fb528 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -27,7 +27,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 2159ac7a1d..978d605c01 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 5239896158..aa28030887 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 18c10e792f..76c7a36742 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 7b4e45184b..fc77c9a1df 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 87ca93870b..ea75265ac4 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 3db8d162e4..35cb88f390 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 95a83546b1..7d897b5d74 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 5af0ae8dbb..f4adf14a64 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -44,7 +44,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Installation", "phase_id": 5}], + kill_chain = [{"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index a984fc0c74..a3f7cfe558 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -46,7 +46,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 1927f56abb..b1aa82b4a5 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, {"phase": "Delivery", "phase_id": 3}, {"phase": "Installation", "phase_id": 5}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index a4d7157c44..771a4d557b 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 3c91c5df52..a686f4c3c2 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index f3dddb5a82..fdd002e2ee 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 4ee4d7edb4..dd7904c920 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 9f81fa8016..d2013a7ba9 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 43c1b36b33..02d3fa295c 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Delivery", "phase_id": 3}], + kill_chain = [{"phase": "Delivery", "phase_id": 3}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 7960274bc8..d4e3a64d62 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 4515d16cc1..264e520ac8 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -49,7 +49,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 6a965d3a5e..ed91e79d98 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -250,7 +250,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 0cf240058f..19606fd404 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 30, impact_id = 2, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 10e487c32c..7feb58809c 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 727e84a790..452a5e0a49 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 424d82b72e..53da9904d9 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -43,7 +43,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 5bac17445c..5248d907c5 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -46,7 +46,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index e097a6d227..67f56b4703 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index d1ea845f14..a28a52caca 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 9fd275acd2..a0e7674aed 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index 450f7a3765..96b6272e40 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 90a4187b19..44ed4c0cbf 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -54,7 +54,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml index 7bb458684e..2edfde46fe 100644 --- a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 489ccac64b..893fa72dd7 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index dcc76e0bb4..3c3a433b0d 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index 804e09936c..ce515b94c0 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -72,7 +72,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 512dd474b8..c16a3e0dee 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -51,7 +51,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 40, impact_id = 3, - kill_chain = {"phase": "Installation", "phase_id": 5}], + kill_chain = [{"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index bc4dec7946..c7b0d2893c 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -43,7 +43,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index da89d537c3..6d84deceb8 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -34,7 +34,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml index 68327e6f3a..46b3b8a30c 100644 --- a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index de392f8484..867f97d856 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -42,7 +42,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Command And Control", "phase_id": 6}], + kill_chain = [{"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index b5d059520e..f1a169e32c 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -71,7 +71,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 7ac7e452bd..ba0b5cfe23 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 49fb0fa644..d11539885e 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index a9ad8f960c..927c2baecc 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index 7d9bc65547..f1ad328297 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 5c68d82120..336e242c38 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index fc19621d48..d3883fe3aa 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 1ca8b9f350..dccad33c0a 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 97b0b8d5a8..5822451f93 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index ac4fe75665..b4555eee73 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -36,7 +36,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 60, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 0dd6e17262..e1073cd717 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 50, impact_id = 3, - kill_chain = {"phase": "Actions on Objectives", "phase_id": 7}], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index ff7265f85f..b5f80f61ad 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -43,7 +43,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index dbe9c8378b..ea35f18b14 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -36,7 +36,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index d98473c520..28ce73517e 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 02be4d7a2d..ca4d697b03 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 28e61dd101..5391fa8a62 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 762064a016..5f6ed8e0e6 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 07b2812db5..ed30b0097a 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 2c4ff2a9d6..b24c8b9483 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -39,7 +39,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index becd6f4593..6fbc7ba587 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 047637fd7f..2a60d7deb9 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 49b729c8db..36dd7eb6e2 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 8bdd3ecf0d..59ba21340c 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -38,7 +38,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 20, impact_id = 2, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Info", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index 8b1e1aa91a..b345a46259 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 40, impact_id = 3, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 3e53f68714..1db12030de 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 0978d59113..f6ac421f3c 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index bda0531cee..05808e34a7 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -40,7 +40,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 100, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 27c927747e..1a106206f9 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -45,7 +45,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 90, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 93e3899975..452cc9a74f 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -48,7 +48,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index dd369547a9..f2e0ef948f 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 03042eac29..92e1a8c8b3 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 3b36e5418d..14a73b3351 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -37,7 +37,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 70, impact_id = 4, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 94d2f62ab3..e6b3ecf4b2 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -41,7 +41,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu duration = 0, impact = 80, impact_id = 5, - kill_chain = {"phase": "Exploitation", "phase_id": 4}], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Critical", category_uid = 2, From 01aec84d9a7ffc1b7a04194b026091e44b06bbc5 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 9 Aug 2023 11:42:41 +0200 Subject: [PATCH 03/89] converted detections to SPL2 --- .../adapter/finding_report_writer.py | 4 +- .../adapter/templates/finding_report.j2 | 10 +-- .../builder/backend_splunk_ba.py | 2 +- ...ssa___anomalous_usage_of_archive_tools.yml | 16 ++-- .../srs/ssa___attempt_to_delete_services.yml | 40 ++++----- .../srs/ssa___attempt_to_disable_services.yml | 40 ++++----- ...dential_dump_from_registry_via_reg_exe.yml | 48 ++++------ ..._bcdedit_failure_recovery_modification.yml | 41 ++++----- ...ar_unallocated_sector_using_cipher_app.yml | 40 ++++----- dist/ssa/srs/ssa___delete_a_net_user.yml | 41 ++++----- ...___deny_permission_using_cacls_utility.yml | 42 ++++----- ...ohibited_applications_spawning_cmd_exe.yml | 52 +++++------ ...ssa___detect_rclone_command_line_usage.yml | 48 ++++------ .../srs/ssa___disable_net_user_account.yml | 41 ++++----- ...___dns_exfiltration_using_nslookup_app.yml | 43 ++++----- dist/ssa/srs/ssa___fsutil_zeroing_file.yml | 40 ++++----- ...__grant_permission_using_cacls_utility.yml | 42 ++++----- ..._files_and_directories_with_attrib_exe.yml | 40 ++++----- ...fy_acls_permission_of_files_or_folders.yml | 44 ++++------ ...e_product_spawning_windows_script_host.yml | 46 ++++------ .../srs/ssa___resize_shadowstorage_volume.yml | 40 ++++----- .../ssa___sdelete_application_execution.yml | 61 ++++++------- ...ocess_running_from_unexpected_location.yml | 80 ++++++++--------- .../ssa___wbadmin_delete_system_backups.yml | 41 ++++----- .../ssa___wevtutil_usage_to_clear_logs.yml | 46 ++++------ .../ssa___wevtutil_usage_to_disable_logs.yml | 40 ++++----- .../ssa___windows_bits_job_persistence.yml | 45 ++++------ .../ssa___windows_bitsadmin_download_file.yml | 40 ++++----- .../ssa___windows_certutil_decode_file.yml | 40 ++++----- ...a___windows_certutil_urlcache_download.yml | 42 ++++----- ...___windows_certutil_verifyctl_download.yml | 42 ++++----- ..._hijacking_inprocserver32_modification.yml | 40 ++++----- ...dows_curl_upload_to_remote_destination.yml | 44 ++++------ ...group_policy_object_modified_with_gpme.yml | 42 ++++----- ...ws_defender_tools_in_non_standard_path.yml | 41 ++++----- ...a___windows_diskshadow_proxy_execution.yml | 40 ++++----- ...ows_dotnet_binary_in_non_standard_path.yml | 87 +++++++++---------- ...ndows_exchange_powershell_module_usage.yml | 33 +++---- ...s_execute_arbitrary_commands_with_msdt.yml | 42 ++++----- ...ws_file_share_discovery_with_powerview.yml | 29 +++---- .../ssa___windows_findstr_gpp_discovery.yml | 40 ++++----- ...s_ingress_tool_transfer_using_explorer.yml | 40 ++++----- ...ows_lolbin_binary_in_non_standard_path.yml | 63 ++++++-------- .../srs/ssa___windows_mshta_child_process.yml | 47 ++++------ .../ssa___windows_mshta_command_line_url.yml | 40 ++++----- ...a___windows_mshta_inline_hta_execution.yml | 41 ++++----- ...___windows_odbcconf_load_response_file.yml | 41 ++++----- ...tial_dumping_with_ntdsutil_export_ntds.yml | 44 ++++------ ...ws_os_credential_dumping_with_procdump.yml | 42 ++++----- ...connect_to_internet_with_hidden_window.yml | 44 ++++------ ...re_authentication_discovery_get_aduser.yml | 30 +++---- ...uthentication_discovery_with_powerview.yml | 31 +++---- .../ssa___windows_powershell_downloadfile.yml | 44 ++++------ ..._windows_powershell_start_bitstransfer.yml | 44 ++++------ ...sa___windows_powersploit_gpp_discovery.yml | 29 +++---- .../ssa___windows_rasautou_dll_execution.yml | 41 ++++----- ...onsole_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...adplus_exe_lolbas_in_non_standard_path.yml | 41 ++++----- ...dvpack_dll_lolbas_in_non_standard_path.yml | 40 ++++----- ...ecutor_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...taller_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...appvlp_exe_lolbas_in_non_standard_path.yml | 41 ++++----- ...mpiler_exe_lolbas_in_non_standard_path.yml | 41 ++++----- ...ies_at_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...broker_exe_lolbas_in_non_standard_path.yml | 40 ++++----- ...__windows_rundll32_comsvcs_memory_dump.yml | 41 ++++----- ..._windows_rundll32_inline_hta_execution.yml | 41 ++++----- ...sa___windows_script_host_spawn_msbuild.yml | 42 ++++----- ...execution_compiled_html_file_decompile.yml | 40 ++++----- ...compiled_html_file_url_in_command_line.yml | 40 ++++----- ...l_file_using_infotech_storage_handlers.yml | 40 ++++----- ...xy_execution_msiexec_dllregisterserver.yml | 40 ++++----- ...roxy_execution_msiexec_remote_download.yml | 40 ++++----- ...proxy_execution_msiexec_unregister_dll.yml | 40 ++++----- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 40 ++++----- ...ssa___anomalous_usage_of_archive_tools.yml | 4 +- .../ssa___attempt_to_delete_services.yml | 28 ++---- .../ssa___attempt_to_disable_services.yml | 28 ++---- ...dential_dump_from_registry_via_reg_exe.yml | 36 +++----- ..._bcdedit_failure_recovery_modification.yml | 29 +++---- ...ar_unallocated_sector_using_cipher_app.yml | 28 ++---- .../endpoint/ssa___delete_a_net_user.yml | 29 +++---- ...___deny_permission_using_cacls_utility.yml | 30 +++---- ...ohibited_applications_spawning_cmd_exe.yml | 40 ++++----- ...ssa___detect_rclone_command_line_usage.yml | 36 +++----- .../ssa___disable_net_user_account.yml | 29 +++---- ...___dns_exfiltration_using_nslookup_app.yml | 31 +++---- .../endpoint/ssa___fsutil_zeroing_file.yml | 28 ++---- ...__grant_permission_using_cacls_utility.yml | 30 +++---- ..._files_and_directories_with_attrib_exe.yml | 28 ++---- ...fy_acls_permission_of_files_or_folders.yml | 32 +++---- ...e_product_spawning_windows_script_host.yml | 34 +++----- .../ssa___resize_shadowstorage_volume.yml | 28 ++---- .../ssa___sdelete_application_execution.yml | 49 +++++------ ...ocess_running_from_unexpected_location.yml | 68 +++++++-------- .../ssa___wbadmin_delete_system_backups.yml | 29 +++---- .../ssa___wevtutil_usage_to_clear_logs.yml | 34 +++----- .../ssa___wevtutil_usage_to_disable_logs.yml | 28 ++---- .../ssa___windows_bits_job_persistence.yml | 33 +++---- .../ssa___windows_bitsadmin_download_file.yml | 28 ++---- .../ssa___windows_certutil_decode_file.yml | 28 ++---- ...a___windows_certutil_urlcache_download.yml | 30 +++---- ...___windows_certutil_verifyctl_download.yml | 30 +++---- ..._hijacking_inprocserver32_modification.yml | 28 ++---- ...dows_curl_upload_to_remote_destination.yml | 32 +++---- ...group_policy_object_modified_with_gpme.yml | 30 +++---- ...ws_defender_tools_in_non_standard_path.yml | 29 +++---- ...a___windows_diskshadow_proxy_execution.yml | 28 ++---- ...ows_dotnet_binary_in_non_standard_path.yml | 75 +++++++--------- ...ndows_exchange_powershell_module_usage.yml | 21 ++--- ...s_execute_arbitrary_commands_with_msdt.yml | 30 +++---- ...ws_file_share_discovery_with_powerview.yml | 17 ++-- .../ssa___windows_findstr_gpp_discovery.yml | 28 ++---- ...s_ingress_tool_transfer_using_explorer.yml | 28 ++---- ...__windows_lateral_tool_transfer_remcom.yml | 29 +++---- ...ows_lolbin_binary_in_non_standard_path.yml | 51 +++++------ .../ssa___windows_mshta_child_process.yml | 35 +++----- .../ssa___windows_mshta_command_line_url.yml | 28 ++---- ...a___windows_mshta_inline_hta_execution.yml | 29 +++---- ...___windows_odbcconf_load_response_file.yml | 29 +++---- ...tial_dumping_with_ntdsutil_export_ntds.yml | 30 +++---- ...ws_os_credential_dumping_with_procdump.yml | 30 +++---- ...connect_to_internet_with_hidden_window.yml | 32 +++---- ...re_authentication_discovery_get_aduser.yml | 18 ++-- ...uthentication_discovery_with_powerview.yml | 19 ++-- .../ssa___windows_powershell_downloadfile.yml | 32 +++---- ..._windows_powershell_export_certificate.yml | 17 ++-- ...ndows_powershell_export_pfxcertificate.yml | 17 ++-- ..._windows_powershell_start_bitstransfer.yml | 32 +++---- ...sa___windows_powersploit_gpp_discovery.yml | 17 ++-- .../ssa___windows_rasautou_dll_execution.yml | 29 +++---- .../ssa___windows_remote_create_service.yml | 29 +++---- ...onsole_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...adplus_exe_lolbas_in_non_standard_path.yml | 29 +++---- ...dvpack_dll_lolbas_in_non_standard_path.yml | 28 ++---- ...ecutor_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...taller_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...appvlp_exe_lolbas_in_non_standard_path.yml | 29 +++---- ...mpiler_exe_lolbas_in_non_standard_path.yml | 29 +++---- ...ies_at_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...broker_exe_lolbas_in_non_standard_path.yml | 28 ++---- ...__windows_rundll32_comsvcs_memory_dump.yml | 29 +++---- ..._windows_rundll32_inline_hta_execution.yml | 29 +++---- ...sa___windows_script_host_spawn_msbuild.yml | 30 +++---- ...sa___windows_service_create_with_tscon.yml | 27 ++---- ...execution_compiled_html_file_decompile.yml | 28 ++---- ...compiled_html_file_url_in_command_line.yml | 28 ++---- ...l_file_using_infotech_storage_handlers.yml | 28 ++---- ...xy_execution_msiexec_dllregisterserver.yml | 28 ++---- ...roxy_execution_msiexec_remote_download.yml | 28 ++---- ...proxy_execution_msiexec_unregister_dll.yml | 28 ++---- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 28 ++---- 152 files changed, 1988 insertions(+), 3375 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index 6eb4892445..adab1ed38b 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -59,12 +59,12 @@ class FindingReportObject(): detection.tags.risk_level_id = 4 detection.tags.risk_level = "Critical" - evidence_str = "[" + evidence_str = "{" for i in range(len(detection.tags.observable)): evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '": ' + detection.tags.observable[i]["name"].replace(".", "_") if not i == (len(detection.tags.observable) - 1): evidence_str = evidence_str + ', ' - evidence_str = evidence_str + ']' + evidence_str = evidence_str + '}' detection.tags.evidence_str = evidence_str diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index f4b933f288..88fa0d2926 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -21,10 +21,10 @@ risk_level_id = {{ detection.tags.risk_level_id }}, risk_score = {{ detection.tags.risk_score }}, severity_id = 0, - rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "{{ detection.name }}", "uid": "{{ detection.id }}", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index f90a9277eb..6e7bac33b0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -64,7 +64,7 @@ class SplunkBABackend(TextQueryBackend): deferred_separator : ClassVar[str] = " OR " deferred_only_query : ClassVar[str] = "*" - wildcard_match_expression : ClassVar[Optional[str]] = "like({field}, {value})" + wildcard_match_expression : ClassVar[Optional[str]] = "{field} LIKE {value}" def __init__(self, processing_pipeline: Optional["sigma.processing.pipeline.ProcessingPipeline"] = None, collect_errors: bool = False, min_time : str = "-30d", max_time : str = "now", detection : Detection = None, field_mapping: dict = None, **kwargs): diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 4c102fb528..fd30d2e083 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -11,11 +11,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" - OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, - "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) + OR process_file_name LIKE "7z%" OR process_file_name LIKE "winzip%") AND (actor_process_file_name + LIKE "%powershell.exe" OR actor_process_file_name LIKE "%cmd.exe") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Anomalous usage of Archive Tools has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -35,11 +35,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me risk_level_id = 2, risk_score = 42, severity_id = 0, - rule = {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 978d605c01..6f48a9783c 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -6,28 +6,18 @@ description: The following analytic identifies Windows Service Control, `sc.exe` instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="sc.exe" AND + process_cmd_line LIKE "%delete%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Attempt To Delete Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 36, severity_id = 0, - rule = {"name": "Attempt To Delete Services", "uid": "a0c8c292-d01a-11eb-aa18-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Attempt To Delete Services", "uid": "a0c8c292-d01a-11eb-aa18-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index aa28030887..cea289aa40 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -6,28 +6,18 @@ description: The following analytic identifies Windows Service Control, `sc.exe` instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") - AND process_file_name="sc.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%config%" + AND process_cmd_line LIKE "%disabled%" AND process_file_name="sc.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Attempt To Disable Services has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 36, severity_id = 0, - rule = {"name": "Attempt To Disable Services", "uid": "afb31de4-d023-11eb-98d5-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Attempt To Disable Services", "uid": "afb31de4-d023-11eb-98d5-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 76c7a36742..0b70137bf5 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -4,32 +4,22 @@ version: 2 description: The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, - /(?i)save/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR + process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Attempted Credential Dump From Registry via Reg exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "Attempted Credential Dump From Registry via Reg exe", "uid": "14038953-e5f2-4daf-acff-5452062baf03", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Attempted Credential Dump From Registry via Reg exe", "uid": "14038953-e5f2-4daf-acff-5452062baf03", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index fc77c9a1df..872d7c12dc 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -4,28 +4,19 @@ version: 1 description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") - AND like(process_cmd_line, "%recoveryenabled%")) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="bcdedit.exe" + AND (process_cmd_line LIKE "%no%" AND process_cmd_line LIKE "%recoveryenabled%") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "BCDEdit Failure Recovery Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "BCDEdit Failure Recovery Modification", "uid": "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "BCDEdit Failure Recovery Modification", "uid": "76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index ea75265ac4..a8326a402f 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -4,28 +4,18 @@ version: 1 description: this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="cipher.exe" + AND process_cmd_line LIKE "%/W:%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Clear Unallocated Sector Using Cipher App has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Clear Unallocated Sector Using Cipher App", "uid": "8f907d90-6173-11ec-9c23-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Clear Unallocated Sector Using Cipher App", "uid": "8f907d90-6173-11ec-9c23-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 35cb88f390..070f034c0b 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -7,28 +7,19 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/delete%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Delete A Net User has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Delete A Net User", "uid": "8776d79c-d26e-11eb-9a56-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Delete A Net User", "uid": "8776d79c-d26e-11eb-9a56-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 7d897b5d74..d22cdf0e33 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -5,29 +5,19 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)deny/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Deny Permission using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Deny Permission using Cacls Utility", "uid": "b76eae28-cd25-11eb-9c92-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Deny Permission using Cacls Utility", "uid": "b76eae28-cd25-11eb-9c92-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index f4adf14a64..95309eb29a 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -5,34 +5,24 @@ description: The following analytic identifies parent processes, browsers, Windo terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" - OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" - OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" - OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" - OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" - AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" - AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((actor_process_file_name="winword.exe" + OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe" + OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" + OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" + OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") + OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, + /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT + process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Detect Prohibited Applications Spawning cmd exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -52,11 +42,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Detect Prohibited Applications Spawning cmd exe", "uid": "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Detect Prohibited Applications Spawning cmd exe", "uid": "c10a18cb-fd80-4ffa-a844-25026e0a0c94", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: In order to successfully implement this analytic, you will need diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index a3f7cfe558..f50f9fc6e7 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -8,33 +8,23 @@ description: This analytic identifies commonly used command-line arguments used is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, - "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, - "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR - like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR - like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, - "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%--multi-thread-streams%" + OR process_cmd_line LIKE "%--transfers%" OR process_cmd_line LIKE "%--auto-confirm%" + OR process_cmd_line LIKE "%--ignore-existing%" OR process_cmd_line LIKE "%--no-check-certificate%" + OR process_cmd_line LIKE "%--progress%" OR process_cmd_line LIKE "%--config%" OR + process_cmd_line LIKE "%ftp%" OR process_cmd_line LIKE "%pcloud%" OR process_cmd_line + LIKE "%mega%" OR process_cmd_line LIKE "%copy%") AND process_file_name="rclone.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Detect RClone Command-Line Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -54,11 +44,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Detect RClone Command-Line Usage", "uid": "e8b74268-5454-11ec-a799-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Detect RClone Command-Line Usage", "uid": "e8b74268-5454-11ec-a799-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index b1aa82b4a5..8ce96a388c 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -5,28 +5,19 @@ description: This analytic will identify a suspicious command-line that disables user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used by the adversaries to interrupt availability of accounts and continue the impact against the organization. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/active:no%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Disable Net User Account has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Disable Net User Account", "uid": "ba858b08-d26c-11eb-af9b-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Disable Net User Account", "uid": "ba858b08-d26c-11eb-af9b-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 771a4d557b..7dd731f656 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -7,29 +7,20 @@ description: This search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") - OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, - "%-querytype=%")) AND process_file_name="nslookup.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-retry=%" + OR process_cmd_line LIKE "%-type=%" OR process_cmd_line LIKE "%-q=%" OR process_cmd_line + LIKE "%-qt=%" OR process_cmd_line LIKE "%-querytype=%") AND process_file_name="nslookup.exe" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "DNS Exfiltration Using Nslookup App has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 72, severity_id = 0, - rule = {"name": "DNS Exfiltration Using Nslookup App", "uid": "2452e632-9e0d-11eb-34ba-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "DNS Exfiltration Using Nslookup App", "uid": "2452e632-9e0d-11eb-34ba-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index a686f4c3c2..a853b913eb 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -4,28 +4,18 @@ version: 1 description: This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%setzerodata%" + AND process_file_name="fsutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Fsutil Zeroing File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 54, severity_id = 0, - rule = {"name": "Fsutil Zeroing File", "uid": "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Fsutil Zeroing File", "uid": "f792cdc9-43ee-4429-a3c0-ffce4fed1a85", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index fdd002e2ee..efe053454f 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -5,29 +5,19 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)grant/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Grant Permission Using Cacls Utility has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Grant Permission Using Cacls Utility", "uid": "c6da561a-cd29-11eb-ae65-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Grant Permission Using Cacls Utility", "uid": "c6da561a-cd29-11eb-ae65-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index dd7904c920..f6ed4535d0 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -5,28 +5,18 @@ description: Attackers leverage an existing Windows binary, attrib.exe, to mark as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe to hide files. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="attrib.exe" + AND match_regex(process_cmd_line, /(?i)/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Hiding Files And Directories With Attrib exe has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 72, severity_id = 0, - rule = {"name": "Hiding Files And Directories With Attrib exe", "uid": "028e4406-6176-11ec-aec2-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Hiding Files And Directories With Attrib exe", "uid": "028e4406-6176-11ec-aec2-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index d2013a7ba9..614ee484b3 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -7,30 +7,20 @@ description: This analytic identifies suspicious modification of ACL permission is commonly configured by the file or directory owner with appropriate permission. This behavior raises suspicion if this command is seen on an endpoint utilized by an account with no permission to do so. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, - /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, + /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Modify ACLs Permission Of Files Or Folders has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Modify ACLs Permission Of Files Or Folders", "uid": "9ae9a48a-cdbe-11eb-875a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Modify ACLs Permission Of Files Or Folders", "uid": "9ae9a48a-cdbe-11eb-875a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 02d3fa295c..b7c405fe3b 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -4,31 +4,21 @@ version: 1 description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe") - AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, - /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true - OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, - /(?i)winword.exe/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" + OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true + OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true + OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Office Product Spawning Windows Script Host has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "Office Product Spawning Windows Script Host", "uid": "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Office Product Spawning Windows Script Host", "uid": "3ea3851a-8736-41a0-bc09-7e4485b48fa6", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index d4e3a64d62..081705d1e0 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -5,29 +5,19 @@ description: The following analytic identifies the resizing of shadowstorage usi vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting the shadowstorage. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, - "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%shadowstorage%" + AND process_cmd_line LIKE "%resize%" AND process_cmd_line LIKE "%maxsize%" AND process_file_name="vssadmin.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Resize Shadowstorage Volume has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 64, severity_id = 0, - rule = {"name": "Resize Shadowstorage Volume", "uid": "dbc30554-d27e-11eb-9e5e-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Resize Shadowstorage Volume", "uid": "dbc30554-d27e-11eb-9e5e-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index 264e520ac8..a7ccdc0862 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -6,38 +6,29 @@ description: This analytic will detect the execution of sdelete.exe attempting t to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") - OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, - "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") - OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, - "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") - OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, - "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") - OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR - like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, - "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR - like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, - "%-c %")) AND like(process_file_name, "%sdelete%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%.xls%" + OR process_cmd_line LIKE "%.gz%" OR process_cmd_line LIKE "%.tar%" OR process_cmd_line + LIKE "%.rar%" OR process_cmd_line LIKE "%.zip%" OR process_cmd_line LIKE "%.7z%" + OR process_cmd_line LIKE "%.bmp%" OR process_cmd_line LIKE "%.gif%" OR process_cmd_line + LIKE "%.png%" OR process_cmd_line LIKE "%.jpg%" OR process_cmd_line LIKE "%.txt%" + OR process_cmd_line LIKE "%.log%" OR process_cmd_line LIKE "%.key%" OR process_cmd_line + LIKE "%.pdf%" OR process_cmd_line LIKE "%.rtf%" OR process_cmd_line LIKE "%.ppt%" + OR process_cmd_line LIKE "%.xls%" OR process_cmd_line LIKE "%.doc%" OR process_cmd_line + LIKE "%-nobanner%" OR process_cmd_line LIKE "%/accepteula%" OR process_cmd_line + LIKE "%-z %" OR process_cmd_line LIKE "%-s %" OR process_cmd_line LIKE "%-q %" OR + process_cmd_line LIKE "%-r %" OR process_cmd_line LIKE "%-p %" OR process_cmd_line + LIKE "%-f %" OR process_cmd_line LIKE "%-c %") AND process_file_name LIKE "%sdelete%" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Sdelete Application Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -57,11 +48,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 42, severity_id = 0, - rule = {"name": "Sdelete Application Execution", "uid": "fcc52b9a-4616-11ec-8454-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Sdelete Application Execution", "uid": "fcc52b9a-4616-11ec-8454-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index ed91e79d98..146de25876 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -7,45 +7,35 @@ description: An attacker tries might try to use different version of a system co run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" - OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" - OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" - OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe" - OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" - OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" - OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" - OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" - OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe" - OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" - OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe" - OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" - OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" - OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" - OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" - OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" - OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" - OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" - OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" - OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" - OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR - process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" + OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" + OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" + OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" + OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" + OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" + OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" + OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" + OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" + OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" + OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" + OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" + OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" + OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" + OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" + OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" + OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" + OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" + OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" + OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" + OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" + OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" @@ -238,7 +228,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu match_regex(process_file_path, /(?i)\\windows\\system32/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "System Process Running from Unexpected Location has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -258,11 +248,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "System Process Running from Unexpected Location", "uid": "28179107-099a-464a-94d3-08301e6c055f", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "System Process Running from Unexpected Location", "uid": "28179107-099a-464a-94d3-08301e6c055f", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 19606fd404..36e7c276bb 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -4,28 +4,19 @@ version: 1 description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") - OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="wbadmin.exe" + AND (process_cmd_line LIKE "%systemstatebackup%" OR process_cmd_line LIKE "%catalog%" + OR process_cmd_line LIKE "%delete%") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "WBAdmin Delete System Backups has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 15, severity_id = 0, - rule = {"name": "WBAdmin Delete System Backups", "uid": "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "WBAdmin Delete System Backups", "uid": "71efbf52-4dbb-4c00-a520-306aa546cbb7", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 7feb58809c..4600574ccf 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -4,31 +4,21 @@ version: 2 description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, - /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line, - /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, - /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, + /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, + /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line + LIKE "% cl %" AND process_file_name="wevtutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "WevtUtil Usage To Clear Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "WevtUtil Usage To Clear Logs", "uid": "5438113c-cdd9-11eb-93b8-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "WevtUtil Usage To Clear Logs", "uid": "5438113c-cdd9-11eb-93b8-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 452a5e0a49..c2d69b55eb 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -4,28 +4,18 @@ version: 2 description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% - sl %") AND process_file_name="wevtutil.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%/e:false%" + AND process_cmd_line LIKE "% sl %" AND process_file_name="wevtutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Wevtutil Usage To Disable Logs has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 63, severity_id = 0, - rule = {"name": "Wevtutil Usage To Disable Logs", "uid": "a4bdc944-cdd9-11eb-ac97-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Wevtutil Usage To Disable Logs", "uid": "a4bdc944-cdd9-11eb-ac97-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 53da9904d9..089db07e18 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -8,30 +8,21 @@ description: The following query identifies Microsoft Background Intelligent Tra the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") - OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") - OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") - OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%resume%" + OR process_cmd_line LIKE "%setcustomheaders%" OR process_cmd_line LIKE "%setminretrydelay%" + OR process_cmd_line LIKE "%setnotifycmdline%" OR process_cmd_line LIKE "%setnotifyflags%" + OR process_cmd_line LIKE "%addfile%" OR process_cmd_line LIKE "%create%") AND process_file_name="bitsadmin.exe" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Bits Job Persistence has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -51,11 +42,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Bits Job Persistence", "uid": "1e25e97a-8ea4-11ec-9767-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Bits Job Persistence", "uid": "1e25e97a-8ea4-11ec-9767-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 5248d907c5..aa092d4b52 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -13,28 +13,18 @@ description: The following query identifies Microsoft Background Intelligent Tra and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%transfer%" + AND process_file_name="bitsadmin.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Bitsadmin Download File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -54,11 +44,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows Bitsadmin Download File", "uid": "d76e8188-8f5a-11ec-ace4-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Bitsadmin Download File", "uid": "d76e8188-8f5a-11ec-ace4-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67f56b4703..4e7e843f0f 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -9,28 +9,18 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%decode%" + AND process_file_name="certutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows CertUtil Decode File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 40, severity_id = 0, - rule = {"name": "Windows CertUtil Decode File", "uid": "b06983f4-8f72-11ec-ab50-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows CertUtil Decode File", "uid": "b06983f4-8f72-11ec-ab50-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index a28a52caca..abd916fa39 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -8,29 +8,19 @@ description: Certutil.exe may download a file from a remote destination using `- However, it is uncommon for `certutil.exe` to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%urlcache%") OR process_cmd_line + LIKE "%urlcache%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows CertUtil URLCache Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows CertUtil URLCache Download", "uid": "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows CertUtil URLCache Download", "uid": "8cb1ad38-8f6d-11ec-87a3-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index a0e7674aed..16e76e711a 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -8,29 +8,19 @@ description: 'Certutil.exe may download a file from a remote destination using ` \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using `-VerifyCtl`, the file will either be written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%verifyctl%") OR + process_cmd_line LIKE "%verifyctl%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows CertUtil VerifyCtl Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows CertUtil VerifyCtl Download", "uid": "9ac29c40-8f6b-11ec-b19a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows CertUtil VerifyCtl Download", "uid": "9ac29c40-8f6b-11ec-b19a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index 96b6272e40..713d4695a6 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -9,28 +9,18 @@ description: The following analytic identifies the use of reg.exe performing an to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + AND process_file_name="reg.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows COM Hijacking InprocServer32 Modification has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 64, severity_id = 0, - rule = {"name": "Windows COM Hijacking InprocServer32 Modification", "uid": "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows COM Hijacking InprocServer32 Modification", "uid": "0ae05a0f-bc84-456b-822a-a5b9c081c7ca", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 44ed4c0cbf..2299d662a5 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -19,30 +19,20 @@ description: 'The following analytic identifies the use of Windows Curl.exe uplo what they are attempting to upload (zip vs txt). During triage, review parallel processes for further behavior. In addition, identify if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data - %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file - %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" + OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + /(?i)curl.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Curl Upload to Remote Destination has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -62,11 +52,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows Curl Upload to Remote Destination", "uid": "cc8d046a-543b-11ec-b864-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Curl Upload to Remote Destination", "uid": "cc8d046a-543b-11ec-b864-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml index 2edfde46fe..95d738b076 100644 --- a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -11,29 +11,19 @@ description: The following analytic identifies the potential edition of a defaul default group policy objects to obtain further access, deploy persistence or execute malware across a large number of hosts. Security teams should monitor the edition of the default GPOs. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="mmc.exe" AND like(process_cmd_line, "%gpme.msc%")) - OR like(process_cmd_line, "%31B2F340-016D-11D2-945F-00C04FB984F9%") OR like(process_cmd_line, - "%6AC1786C-016F-11D2-945F-00C04fB984F9%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="mmc.exe" AND + process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31B2F340-016D-11D2-945F-00C04FB984F9%" + OR process_cmd_line LIKE "%6AC1786C-016F-11D2-945F-00C04fB984F9%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Default Group Policy Object Modified with GPME has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 50, severity_id = 0, - rule = {"name": "Windows Default Group Policy Object Modified with GPME", "uid": "bcb55c13-067b-4648-98f3-627010f72520", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Default Group Policy Object Modified with GPME", "uid": "bcb55c13-067b-4648-98f3-627010f72520", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 893fa72dd7..78c7754fd8 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -3,29 +3,20 @@ id: c205bd2e-cd5b-4224-8510-578a2a1f83d7 version: 1 description: The following analytic identifies usage of the MPCmdRun utility that can be abused by adversaries by moving it to a new directory. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, - /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_file_name, + /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows + defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Defender Tools in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Defender Tools in Non Standard Path", "uid": "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Defender Tools in Non Standard Path", "uid": "c205bd2e-cd5b-4224-8510-578a2a1f83d7", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index 3c3a433b0d..a64ecbb01c 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -7,28 +7,18 @@ description: DiskShadow.exe is a Microsoft Signed binary present on Windows Serv usage of the scripting mode flags in executions of DiskShadow. During triage, compare to known backup behavior in your environment and then review the scripts called by diskshadow. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) - AND process_file_name="diskshadow.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/s%" OR + process_cmd_line LIKE "%-S%") AND process_file_name="diskshadow.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Diskshadow Proxy Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows Diskshadow Proxy Execution", "uid": "aa502688-9037-11ec-842d-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Diskshadow Proxy Execution", "uid": "aa502688-9037-11ec-842d-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index ce515b94c0..b68abc926b 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -7,48 +7,39 @@ description: The following analytic identifies native .net binaries within the W an alert will be generated. Adversaries abuse these binaries as they are native to Windows and native DotNet. Note that not all SDK (post install of Windows) are captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, - /(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true - OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true - OR match_regex(process_file_name, /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, - /(?i)addinprocess.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true - OR match_regex(process_file_name, /(?i)addinutil.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_compiler.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, - /(?i)caspol.exe/)=true OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true - OR match_regex(process_file_name, /(?i)edmgen.exe/)=true OR match_regex(process_file_name, - /(?i)installutil.exe/)=true OR match_regex(process_file_name, /(?i)jsc.exe/)=true - OR match_regex(process_file_name, /(?i)ngentask.exe/)=true OR match_regex(process_file_name, - /(?i)regasm.exe/)=true OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true - OR match_regex(process_file_name, /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, - /(?i)acu.exe/)=true OR match_regex(process_file_name, /(?i)appvstreamingux.exe/)=true - OR match_regex(process_file_name, /(?i)dsac.exe/)=true OR match_regex(process_file_name, - /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.uev.synccontroller.exe/)=true - OR match_regex(process_file_name, /(?i)mtedit.exe/)=true OR match_regex(process_file_name, - /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, /(?i)servermanager.exe/)=true - OR match_regex(process_file_name, /(?i)stordiag.exe/)=true OR match_regex(process_file_name, - /(?i)tzsync.exe/)=true OR match_regex(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true - OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true OR match_regex(process_file_name, - /(?i)uevtemplatebaselinegenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true - OR match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_file_name, + /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true + OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, + /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true + OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, + /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true + OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, + /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true + OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, + /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true + OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, + /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true + OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, + /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true + OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, + /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, + /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true + OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true + OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, + /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true + OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, + /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true + OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR + match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR + match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, @@ -60,7 +51,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows DotNet Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -80,11 +71,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows DotNet Binary in Non Standard Path", "uid": "21179107-099a-324a-94d3-08301e6c065f", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows DotNet Binary in Non Standard Path", "uid": "21179107-099a-324a-94d3-08301e6c065f", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index c16a3e0dee..0824a99345 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -23,23 +23,16 @@ description: 'The following analytic identifies the usage of Exchange PowerShell - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true - OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxexportrequest/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -59,11 +52,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 32, severity_id = 0, - rule = {"name": "Windows Exchange PowerShell Module Usage", "uid": "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Exchange PowerShell Module Usage", "uid": "1118bc65-b0c7-4589-bc2f-ad6802fd0909", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index c7b0d2893c..a48d72f991 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -6,32 +6,22 @@ description: The following analytic identifies a recently disclosed arbitraty co identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Execute Arbitrary Commands with MSDT has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -51,11 +41,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 100, severity_id = 0, - rule = {"name": "Windows Execute Arbitrary Commands with MSDT", "uid": "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Execute Arbitrary Commands with MSDT", "uid": "f253f9c2-10f0-4cc8-b469-f505ba8c2038", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index 6d84deceb8..7fee533d55 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -8,21 +8,14 @@ description: The following analytic identifies the use of the Invoke-ShareFinder credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)invoke-sharefinder/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -42,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 48, severity_id = 0, - rule = {"name": "Windows File Share Discovery With Powerview", "uid": "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows File Share Discovery With Powerview", "uid": "ec4f671e-c736-4f78-a4c0-8fe809e952e5", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml index 46b3b8a30c..4f7b9a7575 100644 --- a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml @@ -9,28 +9,18 @@ description: The following analytic identifies the use of the findstr command em share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="findstr.exe" AND like(process_cmd_line, "%cpassword%") - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="findstr.exe" + AND process_cmd_line LIKE "%cpassword%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Findstr GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Findstr GPP Discovery", "uid": "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Findstr GPP Discovery", "uid": "73ed0f19-080e-4917-b7c6-56e1760a50d4", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index 867f97d856..b87bd54d64 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -9,28 +9,18 @@ description: The following analytic identifies the Windows Explorer process with anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="explorer.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="explorer.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Ingress Tool Transfer Using Explorer has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -50,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 25, severity_id = 0, - rule = {"name": "Windows Ingress Tool Transfer Using Explorer", "uid": "695bfad6-9662-4f9e-a576-bf02a951aa60", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Ingress Tool Transfer Using Explorer", "uid": "695bfad6-9662-4f9e-a576-bf02a951aa60", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index f1a169e32c..0703ad6c87 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -6,36 +6,27 @@ description: The following analytic identifies native living off the land binari it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" - OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" - OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" - OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR - process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe" - OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" OR process_file_name="eventvwr.exe" - OR process_file_name="expand.exe" OR process_file_name="extexport.exe" OR process_file_name="extrac32.exe" - OR process_file_name="findstr.exe" OR process_file_name="finger.exe" OR process_file_name="fltmc.exe" - OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" OR process_file_name="gfxdownloadwrapper.exe" - OR process_file_name="gpscript.exe" OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" - OR process_file_name="ieexec.exe" OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="bitsadmin.exe" + OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" + OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" + OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe" + OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe" + OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" + OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" + OR process_file_name="eventvwr.exe" OR process_file_name="expand.exe" OR process_file_name="extexport.exe" + OR process_file_name="extrac32.exe" OR process_file_name="findstr.exe" OR process_file_name="finger.exe" + OR process_file_name="fltmc.exe" OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" + OR process_file_name="gfxdownloadwrapper.exe" OR process_file_name="gpscript.exe" + OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" + OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" OR + process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="mmc.exe" OR process_file_name="msconfig.exe" OR process_file_name="msdt.exe" OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" OR process_file_name="netsh.exe" OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" @@ -59,7 +50,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu /(?i)(?i)\\microsoft.net/)=true)) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows LOLBin Binary in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -79,11 +70,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows LOLBin Binary in Non Standard Path", "uid": "25689101-012a-324a-94d3-08301e6c065a", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows LOLBin Binary in Non Standard Path", "uid": "25689101-012a-324a-94d3-08301e6c065a", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: Collect endpoint data such as sysmon or 4688 events. diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index ba0b5cfe23..449bb1dedf 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -5,31 +5,22 @@ description: The following analytic identifies child processes spawning from "m The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process "mshta.exe" and its child process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe" - OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" - OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" - OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, - "%mshta.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="wscript.exe" + OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" + OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" + OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" + OR process_file_name="powershell.exe") AND actor_process_file_name LIKE "%mshta.exe" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows MSHTA Child Process has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows MSHTA Child Process", "uid": "f63f7e9c-9526-11ec-9fc7-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows MSHTA Child Process", "uid": "f63f7e9c-9526-11ec-9fc7-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index d11539885e..0ac4383d1c 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -8,28 +8,18 @@ description: This analytic identifies when Microsoft HTML Application Host (msht malicious software to bypass preventative controls. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="mshta.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="mshta.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows MSHTA Command-Line URL has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows MSHTA Command-Line URL", "uid": "9b35c538-94ef-11ec-9439-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows MSHTA Command-Line URL", "uid": "9b35c538-94ef-11ec-9439-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 927c2baecc..cdeda45f39 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -6,28 +6,19 @@ description: The following analytic identifies "mshta.exe" execution with inline invoking HTA content directly on the command-line. The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "mshta.exe" and its parent process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="mshta.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows MSHTA Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows MSHTA Inline HTA Execution", "uid": "24962154-9524-11ec-9333-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows MSHTA Inline HTA Execution", "uid": "24962154-9524-11ec-9333-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index f1ad328297..13ca220cfe 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -6,28 +6,19 @@ description: The following analytic identifies the odbcconf.exe, Windows Open Da and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) - AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%/f %" + OR process_cmd_line LIKE "%-f %") AND process_file_name="odbcconf.exe") AND process_cmd_line + LIKE "%.rsp%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Odbcconf Load Response File has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 42, severity_id = 0, - rule = {"name": "Windows Odbcconf Load Response File", "uid": "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Odbcconf Load Response File", "uid": "7b6c3fac-0c37-4efc-a85e-de88f42b6763", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 336e242c38..53af63f924 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -12,33 +12,23 @@ description: 'Monitor for signs that Ntdsutil is being used to Extract Active Di This technique uses "Install from Media" (IFM), which will extract a copy of the Active Directory database. A successful export of the Active Directory database will yield a file modification named ntds.dit to the destination.' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") - AND like(process_cmd_line, "%ntds%")) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="ntdsutil.exe" + AND (process_cmd_line LIKE "%create%" AND process_cmd_line LIKE "%ntds%") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], - analytic_stories = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"], + analytic_stories = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land", "Volt Typhoon"], class_name = "Detection Report", confidence = 50, confidence_id = 2, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 50, severity_id = 0, - rule = {"name": "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid": "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows OS Credential Dumping with Ntdsutil Export NTDS", "uid": "dad9ddec-a72a-47be-87b6-a0f7ba98ed6e", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting @@ -71,6 +61,7 @@ references: - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: required_fields: - process.pid @@ -111,6 +102,7 @@ tags: - Credential Dumping - HAFNIUM Group - Living Off The Land + - Volt Typhoon cis20: - CIS 10 kill_chain_phases: diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index d3883fe3aa..231a6d9298 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -11,29 +11,19 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.' -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm - %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) - AND like(process_cmd_line, "%lsass%") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%-ma %" + OR process_cmd_line LIKE "%-mm %") AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) + AND process_cmd_line LIKE "%lsass%" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows OS Credential Dumping with Procdump has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows OS Credential Dumping with Procdump", "uid": "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows OS Credential Dumping with Procdump", "uid": "e102e297-dbe6-4a19-b319-5c08f4c19a06", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index dccad33c0a..29a025ccae 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -10,30 +10,20 @@ description: The following hunting analytic identifies PowerShell commands utili For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Powershell Connect to Internet With Hidden Window has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows Powershell Connect to Internet With Hidden Window", "uid": "477e068e-8b6d-11ec-b6c1-81af21670352", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Powershell Connect to Internet With Hidden Window", "uid": "477e068e-8b6d-11ec-b6c1-81af21670352", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting data that records process activity from your diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 5822451f93..be4d210442 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -9,21 +9,15 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, - "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -43,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 54, severity_id = 0, - rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid": "d57b4d91-fc91-4482-a325-47693cced1eb", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser", "uid": "d57b4d91-fc91-4482-a325-47693cced1eb", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index b4555eee73..7650d705bb 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -9,22 +9,15 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + /(?i)get-domainuser/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -44,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 54, severity_id = 0, - rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid": "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView", "uid": "dc3f2af7-ca69-47ce-a122-9f9787e19417", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index e1073cd717..c188824b28 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -6,30 +6,20 @@ description: The following analytic identifies the use of PowerShell downloading PowerShell frameworks to download files and output to disk. Identify the source (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell transaction logs are available, review for further details of the implant. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)downloadfile/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Powershell DownloadFile has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows Powershell DownloadFile", "uid": "46440222-81d5-44b1-a376-19dcd70d1b08", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Powershell DownloadFile", "uid": "46440222-81d5-44b1-a376-19dcd70d1b08", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index b5f80f61ad..2500358d00 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -8,30 +8,20 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)start-bitstransfer/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows PowerShell Start-BitsTransfer has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -51,11 +41,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 49, severity_id = 0, - rule = {"name": "Windows PowerShell Start-BitsTransfer", "uid": "0bafd086-8f61-11ec-996e-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerShell Start-BitsTransfer", "uid": "0bafd086-8f61-11ec-996e-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index ea35f18b14..4650b8e34f 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -10,21 +10,14 @@ description: The following analytic identifies the use of the Get-GPPPassword Po has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-gpppassword/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid], + evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -44,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows PowerSploit GPP Discovery", "uid": "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows PowerSploit GPP Discovery", "uid": "fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this analytic, you will need to enable diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 28ce73517e..a10ab76821 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -5,28 +5,19 @@ description: The following analytic identifies the Windows Windows Remote Auto D rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review parent and child process behavior including file and image loads. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, - /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" + AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, + /(?i)-d /)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rasautou DLL Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows Rasautou DLL Execution", "uid": "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rasautou DLL Execution", "uid": "6f42b8ce-1e15-11ec-ad5a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index ca4d697b03..4a5cb5074e 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -5,29 +5,19 @@ description: The following analytic identifies AccCheckConsole.exe which is a na living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid": "c842931e-661f-42bc-a4df-0460d93cfb69", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path", "uid": "c842931e-661f-42bc-a4df-0460d93cfb69", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 5391fa8a62..01d1fcd8e8 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,19 @@ description: The following analytic identifies adplus.exe which is a native livi off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="adplus.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid": "ecaaf956-c516-4980-b08e-8c01c19614ca", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path", "uid": "ecaaf956-c516-4980-b08e-8c01c19614ca", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 5f6ed8e0e6..cf08319b30 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies Advpack.dll which is a native liv off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="advpack.dll" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid": "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path", "uid": "3284e4f4-67f7-49b6-ad5e-a8fcead2eef8", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index ed30b0097a..44237257b6 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies AgentExecutor.exe which is a nati living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid": "e124f71f-11bc-47e4-9931-6046d256005d", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path", "uid": "e124f71f-11bc-47e4-9931-6046d256005d", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index b24c8b9483..c62a22554f 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -5,29 +5,19 @@ description: The following analytic identifies AppInstaller.exe which is a nativ living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -47,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid": "057c06c7-ef31-4749-b5c9-199152e53a06", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path", "uid": "057c06c7-ef31-4749-b5c9-199152e53a06", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 6fbc7ba587..94e3af2f34 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,19 @@ description: The following analytic identifies Appvlp.exe which is a native livi off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid": "93862a89-abe0-4094-909a-08ec390aa5e3", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path", "uid": "93862a89-abe0-4094-909a-08ec390aa5e3", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 2a60d7deb9..260b51a3e3 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,19 @@ description: The following analytic identifies Aspnet_Compiler.exe which is a na living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +37,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid": "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path", "uid": "d75cc561-3828-4d0a-92c4-0eb93bfe0929", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 36dd7eb6e2..b787c9dcfe 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies At.exe which is a native living o the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="at.exe" AND + (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid": "6401d583-0052-4dc5-a713-68b510826d2b", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities At exe LOLBAS in Non Standard Path", "uid": "6401d583-0052-4dc5-a713-68b510826d2b", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 59ba21340c..5aa120d6d9 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -5,28 +5,18 @@ description: The following analytic identifies Atbroker.exe which is a native li off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -46,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 0, risk_score = 14, severity_id = 0, - rule = {"name": "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid": "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path", "uid": "b8da7ea5-8c16-4eff-9787-54ec271159e0", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you must be ingesting logs diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index b345a46259..deb2cd7983 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -4,28 +4,19 @@ version: 5 description: The following analytic identifies memory dumping using comsvcs.dll with the minidump function with `rundll32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") - AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, + /(?i)comsvcs.dll/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rundll32 Comsvcs Memory Dump has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 40, severity_id = 0, - rule = {"name": "Windows Rundll32 Comsvcs Memory Dump", "uid": "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rundll32 Comsvcs Memory Dump", "uid": "76bb9e35-f314-4c3d-a385-83c72a13ce4e", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: You must be ingesting endpoint data that tracks process activity, diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 1db12030de..f4a5e2e9d8 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -8,28 +8,19 @@ description: The following analytic identifies "rundll32.exe" execution with inl The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "rundll32.exe" and its parent process. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="rundll32.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Rundll32 Inline HTA Execution has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +40,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 2, risk_score = 56, severity_id = 0, - rule = {"name": "Windows Rundll32 Inline HTA Execution", "uid": "0caa1dd6-94f5-11ec-9786-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Rundll32 Inline HTA Execution", "uid": "0caa1dd6-94f5-11ec-9786-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index f6ac421f3c..5492299cdf 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -7,29 +7,19 @@ description: This analytic is to detect a suspicious child process of MSBuild sp malicious script in the compromised host. During triage, review parallel processes and identify any file modifications. MSBuild may load a script from the same path without having command-line arguments. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, - /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + /(?i)wscript.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows Script Host Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows Script Host Spawn MSBuild", "uid": "92886f1c-9b11-11ec-848a-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows Script Host Spawn MSBuild", "uid": "92886f1c-9b11-11ec-848a-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 05808e34a7..a0490d23e7 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -7,28 +7,18 @@ description: The following analytic identifies the decompile parameter with the script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" - +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%-decompile%" + AND process_file_name="hh.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -48,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid": "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Decompile", "uid": "11c32b19-05a6-48a8-ab28-18dbd9ec5d50", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 1a106206f9..c89385f259 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -12,28 +12,18 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a investigation, identify script content origination. Review reputation of remote IP and domain. Some instances, it is worth decompiling the .chm file to review its original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="hh.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="hh.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -53,11 +43,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 90, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid": "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File URL In Command Line", "uid": "0fec631a-7c9b-4e4c-b28b-93260953e25f", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 452cc9a74f..5990a065c7 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -15,28 +15,18 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, - "%its:%")) AND process_file_name="hh.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%mk:@MSITStore:%" + OR process_cmd_line LIKE "%its:%") AND process_file_name="hh.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -56,11 +46,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 3, risk_score = 72, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid": "ba0c2450-caea-4086-ac3a-a71e2659754b", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers", "uid": "ba0c2450-caea-4086-ac3a-a71e2659754b", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index f2e0ef948f..fc5846db7f 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -4,28 +4,18 @@ version: 1 description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) - AND process_file_name="msiexec.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-y %" + OR process_cmd_line LIKE "%/y %") AND process_file_name="msiexec.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid": "8d1d5570-722c-49a3-996c-2e2cceef5163", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution MSIExec DLLRegisterServer", "uid": "8d1d5570-722c-49a3-996c-2e2cceef5163", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 92e1a8c8b3..8a4d2f28dc 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -4,28 +4,18 @@ version: 1 description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it. During triage, review parallel processes and capture any artifacts on disk for review. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="msiexec.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="msiexec.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution MSIExec Remote Download", "uid": "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution MSIExec Remote Download", "uid": "92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 14a73b3351..7f191cc80e 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -4,28 +4,18 @@ version: 1 description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) - AND process_file_name="msiexec.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-z %" + OR process_cmd_line LIKE "%/z %") AND process_file_name="msiexec.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -45,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid": "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows System Binary Proxy Execution MSIExec Unregister DLL", "uid": "df76a8d1-92e1-4ec9-b8f7-695b5838703e", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index e6b3ecf4b2..8968530a9a 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -8,28 +8,18 @@ description: The following analytic identifies wmiprvse.exe spawning msbuild.exe In a malicious instance, MSBuild.exe will spawn from non-standard processes and have no command line arguments. For example, MSBuild.exe spawning from explorer.exe, powershell.exe is far less common and should be investigated. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, - /(?i)wmiprvse.exe/)=true +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, - evidence = ["process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname], + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, message = "Windows WMIPrvse Spawn MSBuild has been triggered on " + device_hostname + " by " + actor_user_name + ".", users = [{"name": actor_user_name, "uid": actor_user.uid}], activity_id = 1, @@ -49,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu risk_level_id = 4, risk_score = 80, severity_id = 0, - rule = {"name": "Windows WMIPrvse Spawn MSBuild", "uid": "76b3b290-9b31-11ec-a934-acde48001122", "type": "Streaming"), - metadata = {"customer_uid": metadata.customer_uid, "product": {"name", "Behavior Analytics", "vendor_name", "Splunk"}, "version", "1.0.0-rc.2", "logged_time", time()}, - "type_uid", 10200101, - "start_time", timestamp, - "end_time", timestamp + rule = {"name": "Windows WMIPrvse Spawn MSBuild", "uid": "76b3b290-9b31-11ec-a934-acde48001122", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time | into sink; ' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index b5b2ebfeda..f33f51c751 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -17,8 +17,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="WinRAR.exe" - OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, - "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' + OR process_file_name LIKE "7z%" OR process_file_name LIKE "winzip%") AND (actor_process_file_name + LIKE "%powershell.exe" OR actor_process_file_name LIKE "%cmd.exe") --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml index cb2b668a3f..c3c7cd2217 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml @@ -12,25 +12,15 @@ description: The following analytic identifies Windows Service Control, `sc.exe` services to continue there objective and evade detections. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="sc.exe" AND + process_cmd_line LIKE "%delete%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml index 358274fd08..60d0bb5063 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml @@ -12,25 +12,15 @@ description: The following analytic identifies Windows Service Control, `sc.exe` services to continue there objective and evade detections. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") - AND process_file_name="sc.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%config%" + AND process_cmd_line LIKE "%disabled%" AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 8c03c1170b..0c816a5a0a 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -10,29 +10,19 @@ description: The following analytic identifies the use of `reg.exe` attempting t this technique to capture and perform offline password cracking. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, - /(?i)save/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR + process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true + OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, + /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml index 10067381ed..648dc87fc4 100644 --- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -10,25 +10,16 @@ description: This search looks for flags passed to bcdedit.exe modifications to to prevent recovery. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") - AND like(process_cmd_line, "%recoveryenabled%")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="bcdedit.exe" + AND (process_cmd_line LIKE "%no%" AND process_cmd_line LIKE "%recoveryenabled%") + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml index 4d6abb2fb4..082417f901 100644 --- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -10,25 +10,15 @@ description: this search is to detect execution of `cipher.exe` to clear the una impossible to forensically recover deleted files. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="cipher.exe" + AND process_cmd_line LIKE "%/W:%" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml index 0b7efb37b6..0c92f19069 100644 --- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml +++ b/ssa_detections/endpoint/ssa___delete_a_net_user.yml @@ -13,25 +13,16 @@ description: This analytic will detect a suspicious net.exe/net1.exe command-lin any other user accounts created before or after. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/delete%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index bd18dc381d..b04c82576e 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -11,26 +11,16 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e adversary files on disk. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)deny/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 5b8c1e4f57..5e7e5f32b3 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -11,31 +11,21 @@ description: The following analytic identifies parent processes, browsers, Windo need to be tuned to further enhance the risk. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" - OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" - OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" - OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" - OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" - AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" - AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((actor_process_file_name="winword.exe" + OR actor_process_file_name="excel.exe" OR actor_process_file_name="outlook.exe" + OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" + OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" + OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") + OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, + /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT + process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" --finding_report--' how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml index 74ecbde3b8..54126b3ce8 100644 --- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -14,29 +14,19 @@ description: This analytic identifies commonly used command-line arguments used investigating by review file modifications and parallel processes. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, - "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, - "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR - like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR - like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, - "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%--multi-thread-streams%" + OR process_cmd_line LIKE "%--transfers%" OR process_cmd_line LIKE "%--auto-confirm%" + OR process_cmd_line LIKE "%--ignore-existing%" OR process_cmd_line LIKE "%--no-check-certificate%" + OR process_cmd_line LIKE "%--progress%" OR process_cmd_line LIKE "%--config%" OR + process_cmd_line LIKE "%ftp%" OR process_cmd_line LIKE "%pcloud%" OR process_cmd_line + LIKE "%mega%" OR process_cmd_line LIKE "%copy%") AND process_file_name="rclone.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml index 1af618919e..9ac1cb56ac 100644 --- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml +++ b/ssa_detections/endpoint/ssa___disable_net_user_account.yml @@ -11,25 +11,16 @@ description: This analytic will identify a suspicious command-line that disables impact against the organization. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") - AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%user%" + AND process_cmd_line LIKE "%/active:no%" AND (process_file_name="net.exe" OR process_file_name="net1.exe") + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 479110d105..42f165f747 100644 --- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -13,26 +13,17 @@ description: This search is to detect potential DNS exfiltration using nslookup C2 DNS multiple tries. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") - OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, - "%-querytype=%")) AND process_file_name="nslookup.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-retry=%" + OR process_cmd_line LIKE "%-type=%" OR process_cmd_line LIKE "%-q=%" OR process_cmd_line + LIKE "%-qt=%" OR process_cmd_line LIKE "%-querytype=%") AND process_file_name="nslookup.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml index f4c6e3fa0d..d16c8727c3 100644 --- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -10,25 +10,15 @@ description: This search is to detect a suspicious fsutil process to zeroing a t malware path as part of its defense evasion after encrypting the compromised host. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%setzerodata%" + AND process_file_name="fsutil.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index aec2f7bbb0..021a4a0d0a 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -11,26 +11,16 @@ description: The following analytic identifies the use of `cacls.exe`, `icacls.e responders to review or gaining access to adversary files on disk. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + /(?i)grant/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index 559e5078c7..d701cedbc0 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -11,25 +11,15 @@ description: Attackers leverage an existing Windows binary, attrib.exe, to mark to hide files. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="attrib.exe" + AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 56be05c9ba..f5162ac060 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -13,27 +13,17 @@ description: This analytic identifies suspicious modification of ACL permission an account with no permission to do so. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, - /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND - (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, + /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index 22fa4abe4d..434231093c 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -10,28 +10,18 @@ description: The following analytic will identify a Windows Office Product spawn usage that may spawn scripts from an Office product. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe") - AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, - /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true - OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, - /(?i)winword.exe/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" + OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true + OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true + OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml index 14e8a6f7c5..84a5006170 100644 --- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -11,25 +11,15 @@ description: The following analytic identifies the resizing of shadowstorage usi the shadowstorage. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, - "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%shadowstorage%" + AND process_cmd_line LIKE "%resize%" AND process_cmd_line LIKE "%maxsize%" AND process_file_name="vssadmin.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml index 0db0a277f5..60a7d419b7 100644 --- a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml +++ b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml @@ -12,35 +12,26 @@ description: This analytic will detect the execution of sdelete.exe attempting t artifact on the targeted host. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") - OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, - "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") - OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, - "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") - OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, - "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") - OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR - like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, - "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR - like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, - "%-c %")) AND like(process_file_name, "%sdelete%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%.xls%" + OR process_cmd_line LIKE "%.gz%" OR process_cmd_line LIKE "%.tar%" OR process_cmd_line + LIKE "%.rar%" OR process_cmd_line LIKE "%.zip%" OR process_cmd_line LIKE "%.7z%" + OR process_cmd_line LIKE "%.bmp%" OR process_cmd_line LIKE "%.gif%" OR process_cmd_line + LIKE "%.png%" OR process_cmd_line LIKE "%.jpg%" OR process_cmd_line LIKE "%.txt%" + OR process_cmd_line LIKE "%.log%" OR process_cmd_line LIKE "%.key%" OR process_cmd_line + LIKE "%.pdf%" OR process_cmd_line LIKE "%.rtf%" OR process_cmd_line LIKE "%.ppt%" + OR process_cmd_line LIKE "%.xls%" OR process_cmd_line LIKE "%.doc%" OR process_cmd_line + LIKE "%-nobanner%" OR process_cmd_line LIKE "%/accepteula%" OR process_cmd_line + LIKE "%-z %" OR process_cmd_line LIKE "%-s %" OR process_cmd_line LIKE "%-q %" OR + process_cmd_line LIKE "%-r %" OR process_cmd_line LIKE "%-p %" OR process_cmd_line + LIKE "%-f %" OR process_cmd_line LIKE "%-c %") AND process_file_name LIKE "%sdelete%" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 4782fdb7f9..7b8d39b06c 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -13,45 +13,35 @@ description: An attacker tries might try to use different version of a system co and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" - OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" - OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" - OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe" - OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" - OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" - OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" - OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" - OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe" - OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" - OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe" - OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" - OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" - OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" - OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" - OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" - OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" - OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" - OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" - OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" - OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR - process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" + OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" + OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" + OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" + OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" + OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" + OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" + OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" + OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" + OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" + OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" + OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" + OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" + OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" + OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" + OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" + OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" + OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" + OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" + OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" + OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" + OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml index 57350b2a5f..ade37b9816 100644 --- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -10,25 +10,16 @@ description: This search looks for flags passed to wbadmin.exe (Windows Backup A recovery. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") - OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="wbadmin.exe" + AND (process_cmd_line LIKE "%systemstatebackup%" OR process_cmd_line LIKE "%catalog%" + OR process_cmd_line LIKE "%delete%") --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index e3188eeac6..70e72eda41 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -10,28 +10,18 @@ description: The wevtutil.exe application is the windows event log utility. This powershell, sysmon, or system event logs. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, - /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line, - /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, - /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, + /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, + /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line + LIKE "% cl %" AND process_file_name="wevtutil.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index 8309897e63..fea74b71fd 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -10,25 +10,15 @@ description: This search is to detect execution of wevtutil.exe to disable logs. and detections in compromised host. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% - sl %") AND process_file_name="wevtutil.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%/e:false%" + AND process_cmd_line LIKE "% sl %" AND process_file_name="wevtutil.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml index 477e43b714..daf1f5e452 100644 --- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -14,27 +14,18 @@ description: The following query identifies Microsoft Background Intelligent Tra identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") - OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") - OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") - OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%resume%" + OR process_cmd_line LIKE "%setcustomheaders%" OR process_cmd_line LIKE "%setminretrydelay%" + OR process_cmd_line LIKE "%setnotifycmdline%" OR process_cmd_line LIKE "%setnotifyflags%" + OR process_cmd_line LIKE "%addfile%" OR process_cmd_line LIKE "%create%") AND process_file_name="bitsadmin.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml index 580df7e9ec..1f081b9633 100644 --- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -19,25 +19,15 @@ description: The following query identifies Microsoft Background Intelligent Tra to list out the jobs during investigation. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%transfer%" + AND process_file_name="bitsadmin.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml index 4b5caa023a..b29ebbf928 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -15,25 +15,15 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including Review its contents or execution behavior for further analysis. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%decode%" + AND process_file_name="certutil.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml index c4804364a8..021f54aab8 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -14,26 +14,16 @@ description: Certutil.exe may download a file from a remote destination using `- remote IP or domain in question. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%urlcache%") OR process_cmd_line + LIKE "%urlcache%" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index be0dcadd4a..342885f6dc 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -14,26 +14,16 @@ description: 'Certutil.exe may download a file from a remote destination using ` written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\`. ' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") - AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="certutil.exe" + AND process_cmd_line LIKE "%split%" AND process_cmd_line LIKE "%verifyctl%") OR + process_cmd_line LIKE "%verifyctl%" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index 1e1801b118..c406297a5b 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -15,25 +15,15 @@ description: The following analytic identifies the use of reg.exe performing an the adversary's code will be executed instead. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + AND process_file_name="reg.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index 0eef7c072c..b73a56ab71 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -25,27 +25,17 @@ description: 'The following analytic identifies the use of Windows Curl.exe uplo in network logs. If a file was uploaded, isolate the endpoint and review.' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data - %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file - %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" + OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + /(?i)curl.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml index 97b6acf6b2..b25cc43b1e 100644 --- a/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/ssa_detections/endpoint/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -17,26 +17,16 @@ description: The following analytic identifies the potential edition of a defaul of the default GPOs. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="mmc.exe" AND like(process_cmd_line, "%gpme.msc%")) - OR like(process_cmd_line, "%31B2F340-016D-11D2-945F-00C04FB984F9%") OR like(process_cmd_line, - "%6AC1786C-016F-11D2-945F-00C04fB984F9%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="mmc.exe" AND + process_cmd_line LIKE "%gpme.msc%") OR process_cmd_line LIKE "%31B2F340-016D-11D2-945F-00C04FB984F9%" + OR process_cmd_line LIKE "%6AC1786C-016F-11D2-945F-00C04fB984F9%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index 68f28a13d9..9db25d56d3 100644 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -9,25 +9,16 @@ description: The following analytic identifies usage of the MPCmdRun utility tha can be abused by adversaries by moving it to a new directory. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, - /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_file_name, + /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows + defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml index ea66adef4d..c5eebba164 100644 --- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -13,25 +13,15 @@ description: DiskShadow.exe is a Microsoft Signed binary present on Windows Serv by diskshadow. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) - AND process_file_name="diskshadow.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/s%" OR + process_cmd_line LIKE "%-S%") AND process_file_name="diskshadow.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index 6ef87c5781..1cb6c75f94 100644 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -13,48 +13,39 @@ description: The following analytic identifies native .net binaries within the W captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, - /(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true - OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true - OR match_regex(process_file_name, /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, - /(?i)addinprocess.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true - OR match_regex(process_file_name, /(?i)addinutil.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_compiler.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, - /(?i)caspol.exe/)=true OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true - OR match_regex(process_file_name, /(?i)edmgen.exe/)=true OR match_regex(process_file_name, - /(?i)installutil.exe/)=true OR match_regex(process_file_name, /(?i)jsc.exe/)=true - OR match_regex(process_file_name, /(?i)ngentask.exe/)=true OR match_regex(process_file_name, - /(?i)regasm.exe/)=true OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true - OR match_regex(process_file_name, /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, - /(?i)acu.exe/)=true OR match_regex(process_file_name, /(?i)appvstreamingux.exe/)=true - OR match_regex(process_file_name, /(?i)dsac.exe/)=true OR match_regex(process_file_name, - /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.uev.synccontroller.exe/)=true - OR match_regex(process_file_name, /(?i)mtedit.exe/)=true OR match_regex(process_file_name, - /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, /(?i)servermanager.exe/)=true - OR match_regex(process_file_name, /(?i)stordiag.exe/)=true OR match_regex(process_file_name, - /(?i)tzsync.exe/)=true OR match_regex(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true - OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true OR match_regex(process_file_name, - /(?i)uevtemplatebaselinegenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true - OR match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_file_name, + /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true + OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, + /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true + OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, + /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true + OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, + /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true + OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, + /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true + OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, + /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true + OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, + /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true + OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, + /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, + /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true + OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true + OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, + /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true + OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, + /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true + OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR + match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR + match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml index 54989536c3..a3f7a5035e 100644 --- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml @@ -29,20 +29,13 @@ description: 'The following analytic identifies the usage of Exchange PowerShell mail contacts, and distribution groups).' data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true - OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxexportrequest/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 4e22c110a1..07f0d4b0df 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -12,26 +12,16 @@ description: The following analytic identifies a recently disclosed arbitraty co process execution that may be related, including an Office Product. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, - "%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" + OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true --finding_report--' diff --git a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml index 9fc3a90784..c1efe0a14a 100644 --- a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml @@ -14,18 +14,11 @@ description: The following analytic identifies the use of the Invoke-ShareFinder or Lateral Movement. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)invoke-sharefinder/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml index 9a807b25d7..3990d363b0 100644 --- a/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml +++ b/ssa_detections/endpoint/ssa___windows_findstr_gpp_discovery.yml @@ -15,25 +15,15 @@ description: The following analytic identifies the use of the findstr command em existing Group Policy Preferences files with passwords are not removed from SYSVOL. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="findstr.exe" AND like(process_cmd_line, "%cpassword%") - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="findstr.exe" + AND process_cmd_line LIKE "%cpassword%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml index 19b0ead9d5..bd290f26df 100644 --- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -15,25 +15,15 @@ description: The following analytic identifies the Windows Explorer process with is not commonly used to open an URL. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="explorer.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="explorer.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml index 7250c821d4..5ff0ea5241 100644 --- a/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml +++ b/ssa_detections/endpoint/ssa___windows_lateral_tool_transfer_remcom.yml @@ -10,25 +10,16 @@ description: This analytic identifies the use of RemCom.exe - The open source ps remotely. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%/user:%") OR like(process_cmd_line, "%/pwd:%") - OR like(process_cmd_line, "%\\%")) AND process_file_name="remcom.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%/user:%" + OR process_cmd_line LIKE "%/pwd:%" OR process_cmd_line LIKE "%\\%") AND process_file_name="remcom.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index 54af1e4cce..007bd8d679 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -12,36 +12,27 @@ description: The following analytic identifies native living off the land binari regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" - OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" - OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" - OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR - process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe" - OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" OR process_file_name="eventvwr.exe" - OR process_file_name="expand.exe" OR process_file_name="extexport.exe" OR process_file_name="extrac32.exe" - OR process_file_name="findstr.exe" OR process_file_name="finger.exe" OR process_file_name="fltmc.exe" - OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" OR process_file_name="gfxdownloadwrapper.exe" - OR process_file_name="gpscript.exe" OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" - OR process_file_name="ieexec.exe" OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="bitsadmin.exe" + OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" + OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" + OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe" + OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe" + OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" + OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" OR process_file_name="esentutl.exe" + OR process_file_name="eventvwr.exe" OR process_file_name="expand.exe" OR process_file_name="extexport.exe" + OR process_file_name="extrac32.exe" OR process_file_name="findstr.exe" OR process_file_name="finger.exe" + OR process_file_name="fltmc.exe" OR process_file_name="forfiles.exe" OR process_file_name="ftp.exe" + OR process_file_name="gfxdownloadwrapper.exe" OR process_file_name="gpscript.exe" + OR process_file_name="imewdbld.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" + OR process_file_name="ilasm.exe" OR process_file_name="infdefaultinstall.exe" OR + process_file_name="makecab.exe" OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="mmc.exe" OR process_file_name="msconfig.exe" OR process_file_name="msdt.exe" OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" OR process_file_name="netsh.exe" OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml index f37120c357..27226312ef 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml @@ -11,28 +11,19 @@ description: The following analytic identifies child processes spawning from "m "mshta.exe" and its child process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe" - OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" - OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" - OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, - "%mshta.exe") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="wscript.exe" + OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" + OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" + OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" + OR process_file_name="powershell.exe") AND actor_process_file_name LIKE "%mshta.exe" + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml index 05cf77767c..aca5330bd7 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml @@ -14,25 +14,15 @@ description: This analytic identifies when Microsoft HTML Application Host (msht as well as the target system, the user, process "rundll32.exe" and its parent process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="mshta.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="mshta.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml index 596fb1de8c..5a5bee65d3 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -12,25 +12,16 @@ description: The following analytic identifies "mshta.exe" execution with inline as well as the target system, the user, process "mshta.exe" and its parent process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="mshta.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml index cf48c2debf..7922777483 100644 --- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml @@ -12,25 +12,16 @@ description: The following analytic identifies the odbcconf.exe, Windows Open Da During triage, review file modifications and parallel processes. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) - AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%/f %" + OR process_cmd_line LIKE "%-f %") AND process_file_name="odbcconf.exe") AND process_cmd_line + LIKE "%.rsp%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 0f995ae31b..ab807767f5 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -18,25 +18,15 @@ description: 'Monitor for signs that Ntdsutil is being used to Extract Active Di will yield a file modification named ntds.dit to the destination.' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") - AND like(process_cmd_line, "%ntds%")) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="ntdsutil.exe" + AND (process_cmd_line LIKE "%create%" AND process_cmd_line LIKE "%ntds%") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -48,11 +38,13 @@ references: - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11) - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: analytic_story: - Credential Dumping - HAFNIUM Group - Living Off The Land + - Volt Typhoon asset_type: Endpoint confidence: 50 impact: 100 diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml index 29f8863b1b..d4ba5ce686 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml @@ -17,26 +17,16 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo into lsass.exe.' data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm - %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) - AND like(process_cmd_line, "%lsass%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%-ma %" + OR process_cmd_line LIKE "%-mm %") AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) + AND process_cmd_line LIKE "%lsass%" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index fcdadc10e5..3d0a855c61 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -16,27 +16,17 @@ description: The following hunting analytic identifies PowerShell commands utili the hyphen. We have added endash, emdash, horizontal bar, and forward slash. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index d161cbe9ff..f56ba45e87 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -15,18 +15,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev their passwords offline. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, - "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 55afcb9a07..a3da967bc8 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -15,19 +15,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev and attempt to crack their passwords offline. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + /(?i)get-domainuser/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 22cfaf36b6..6bf321e9a0 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -12,27 +12,17 @@ description: The following analytic identifies the use of PowerShell downloading transaction logs are available, review for further details of the implant. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)downloadfile/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml index 3e2c96fb12..7d4390f1d4 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml @@ -11,18 +11,11 @@ description: The following analytic identifies the PowerShell Cmdlet export-cert Store. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)export-certificate/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)export-certificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml index c375c6604d..f4a7e2b33e 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -11,18 +11,11 @@ description: The following analytic identifies the PowerShell Cmdlet export-pfxc Store. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)export-pfxcertificate/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)export-pfxcertificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index bbd6c30d1f..7d5b4a4e21 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -14,27 +14,17 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si domain or IP, what is the reputation? data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" - OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" + OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + /(?i)start-bitstransfer/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. diff --git a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml index 7c904bfeaa..4f7d937a0d 100644 --- a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml +++ b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml @@ -16,18 +16,11 @@ description: The following analytic identifies the use of the Get-GPPPassword Po are not removed from SYSVOL. data_source: - Powershell 4104 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), - "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", - null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) - | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | - eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, - /(?i)get-gpppassword/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval device_hostname = device.hostname | eval process_file = process.file | eval + process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid + | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index a8765ced9b..fab57125a0 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -11,25 +11,16 @@ description: The following analytic identifies the Windows Windows Remote Auto D parent and child process behavior including file and image loads. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, - /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" + AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, + /(?i)-d /)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index e60d1050f1..6002889d2d 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -11,25 +11,16 @@ description: This analytic identifies an endpoint that remotely connects to anot with all the resulting service information. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)create/)=true OR match_regex(process_cmd_line, - /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)create/)=true OR match_regex(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index a7fb7fcc2f..2f7f6fc4d5 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies AccCheckConsole.exe which is a na was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index a25578275c..95c9c571aa 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,16 @@ description: The following analytic identifies adplus.exe which is a native livi was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="adplus.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 4ece03abc5..e3f7d60f8b 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies Advpack.dll which is a native liv was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="advpack.dll" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index e501a1e021..a8af25142f 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies AgentExecutor.exe which is a nati was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index ae25453e47..1f1f8446fc 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies AppInstaller.exe which is a nativ was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 6f8496d0b7..c13db65c31 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,16 @@ description: The following analytic identifies Appvlp.exe which is a native livi was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, - /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" + AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 518186bc0a..a57ca72320 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,16 @@ description: The following analytic identifies Aspnet_Compiler.exe which is a na was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 065beffafe..58cb8ce16a 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies At.exe which is a native living o derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="at.exe" AND + (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index d8061c5c35..ce2726da1a 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -11,25 +11,15 @@ description: The following analytic identifies Atbroker.exe which is a native li was derived from the https://lolbas-project.github.io site. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true) --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" + AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index 41d78ec4ab..f888aa997b 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -10,25 +10,16 @@ description: The following analytic identifies memory dumping using comsvcs.dll who would like to dump the memory of lsass.exe. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") - AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, + /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, + /(?i)comsvcs.dll/)=true --finding_report--' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 2de0b7b3aa..2ed5d482c2 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -14,25 +14,16 @@ description: The following analytic identifies "rundll32.exe" execution with inl "rundll32.exe" and its parent process. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") - OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%about%" + OR process_cmd_line LIKE "%javascript%" OR process_cmd_line LIKE "%vbscript%") AND + process_file_name="rundll32.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index b169c9e05b..cdb9b2a5da 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -13,26 +13,16 @@ description: This analytic is to detect a suspicious child process of MSBuild sp without having command-line arguments. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, - /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + /(?i)wscript.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml index 6f347bc2a4..0e8bfb1854 100644 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -16,24 +16,15 @@ description: The following analytic detects potential RDP Hijacking attempts by mitigating potential risks and impacts on targeted systems. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%/dest:rdp-tcp%") --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)/dest:rdp-tcp/)=true + AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index bcc100d5c2..7c104da311 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -13,25 +13,15 @@ description: The following analytic identifies the decompile parameter with the the next stage. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" - --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_cmd_line LIKE "%-decompile%" + AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 49ac3c20a6..8fe198cecf 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -18,25 +18,15 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="hh.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index abd8a1442d..5070b3336c 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -21,25 +21,15 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a C:\Windows\syswow64. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, - "%its:%")) AND process_file_name="hh.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%mk:@MSITStore:%" + OR process_cmd_line LIKE "%its:%") AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index c314f2f25d..7b90b0f9f5 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -10,25 +10,15 @@ description: The following analytic identifies the usage of msiexec.exe using th Upon triage, review parent process and capture any artifacts for further review. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) - AND process_file_name="msiexec.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-y %" + OR process_cmd_line LIKE "%/y %") AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index a4494465de..60829a59b0 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -10,25 +10,15 @@ description: The following analytic identifies msiexec.exe with http in the comm triage, review parallel processes and capture any artifacts on disk for review. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) - AND process_file_name="msiexec.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%https://%" + OR process_cmd_line LIKE "%http://%") AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index e13bc11735..d63f023d28 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -10,25 +10,15 @@ description: The following analytic identifies the usage of msiexec.exe using th Upon triage, review parent process and capture any artifacts for further review. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) - AND process_file_name="msiexec.exe" --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-z %" + OR process_cmd_line LIKE "%/z %") AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index 7d6d33ddad..cc5fd105fd 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -14,25 +14,15 @@ description: The following analytic identifies wmiprvse.exe spawning msbuild.exe powershell.exe is far less common and should be investigated. data_source: - Windows Security 4688 -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), - "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), - "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), - "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, - /(?i)wmiprvse.exe/)=true --finding_report--' +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" + AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From da3d925adf3e3fab5b5902b1d48e6b75c3e077c5 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 9 Aug 2023 14:11:24 +0200 Subject: [PATCH 04/89] converted detections to SPL2 --- .../adapter/finding_report_writer.py | 1 - .../adapter/templates/finding_report.j2 | 4 +- .../builder/backend_splunk_ba.py | 2 +- .../srs/ssa___attempt_to_delete_services.yml | 2 +- ...dential_dump_from_registry_via_reg_exe.yml | 10 +-- ...___deny_permission_using_cacls_utility.yml | 2 +- ...ohibited_applications_spawning_cmd_exe.yml | 6 +- .../srs/ssa___disable_net_user_account.yml | 2 +- ...__grant_permission_using_cacls_utility.yml | 2 +- ..._files_and_directories_with_attrib_exe.yml | 2 +- ...fy_acls_permission_of_files_or_folders.yml | 8 +-- ...e_product_spawning_windows_script_host.yml | 8 +-- .../ssa___sdelete_application_execution.yml | 2 +- ...ocess_running_from_unexpected_location.yml | 4 +- .../ssa___wevtutil_usage_to_clear_logs.yml | 10 +-- .../ssa___windows_bits_job_persistence.yml | 2 +- .../ssa___windows_bitsadmin_download_file.yml | 2 +- ..._hijacking_inprocserver32_modification.yml | 4 +- ...dows_curl_upload_to_remote_destination.yml | 2 +- ...ws_defender_tools_in_non_standard_path.yml | 7 +- ...ows_dotnet_binary_in_non_standard_path.yml | 67 +++++++++---------- ...ndows_exchange_powershell_module_usage.yml | 10 +-- ...s_execute_arbitrary_commands_with_msdt.yml | 6 +- ...ws_file_share_discovery_with_powerview.yml | 6 +- ...ows_lolbin_binary_in_non_standard_path.yml | 10 +-- ...connect_to_internet_with_hidden_window.yml | 2 +- ...re_authentication_discovery_get_aduser.yml | 6 +- ...uthentication_discovery_with_powerview.yml | 6 +- .../ssa___windows_powershell_downloadfile.yml | 2 +- ..._windows_powershell_start_bitstransfer.yml | 4 +- ...sa___windows_powersploit_gpp_discovery.yml | 6 +- .../ssa___windows_rasautou_dll_execution.yml | 4 +- ...onsole_exe_lolbas_in_non_standard_path.yml | 2 +- ...adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...dvpack_dll_lolbas_in_non_standard_path.yml | 2 +- ...ecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...taller_exe_lolbas_in_non_standard_path.yml | 2 +- ...appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...mpiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...ies_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...broker_exe_lolbas_in_non_standard_path.yml | 2 +- ...__windows_rundll32_comsvcs_memory_dump.yml | 6 +- ...sa___windows_script_host_spawn_msbuild.yml | 2 +- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- ...dential_dump_from_registry_via_reg_exe.yml | 10 +-- ...___deny_permission_using_cacls_utility.yml | 2 +- ...ohibited_applications_spawning_cmd_exe.yml | 6 +- ...__grant_permission_using_cacls_utility.yml | 2 +- ..._files_and_directories_with_attrib_exe.yml | 2 +- ...fy_acls_permission_of_files_or_folders.yml | 8 +-- ...e_product_spawning_windows_script_host.yml | 8 +-- ...ocess_running_from_unexpected_location.yml | 4 +- .../ssa___wevtutil_usage_to_clear_logs.yml | 10 +-- ..._hijacking_inprocserver32_modification.yml | 2 +- ...dows_curl_upload_to_remote_destination.yml | 2 +- ...ws_defender_tools_in_non_standard_path.yml | 7 +- ...ows_dotnet_binary_in_non_standard_path.yml | 67 +++++++++---------- ...ndows_exchange_powershell_module_usage.yml | 6 +- ...s_execute_arbitrary_commands_with_msdt.yml | 6 +- ...ws_file_share_discovery_with_powerview.yml | 2 +- ...ows_lolbin_binary_in_non_standard_path.yml | 10 +-- ...connect_to_internet_with_hidden_window.yml | 2 +- ...re_authentication_discovery_get_aduser.yml | 2 +- ...uthentication_discovery_with_powerview.yml | 2 +- .../ssa___windows_powershell_downloadfile.yml | 2 +- ..._windows_powershell_export_certificate.yml | 2 +- ...ndows_powershell_export_pfxcertificate.yml | 2 +- ..._windows_powershell_start_bitstransfer.yml | 2 +- ...sa___windows_powersploit_gpp_discovery.yml | 2 +- .../ssa___windows_rasautou_dll_execution.yml | 4 +- .../ssa___windows_remote_create_service.yml | 5 +- ...onsole_exe_lolbas_in_non_standard_path.yml | 2 +- ...adplus_exe_lolbas_in_non_standard_path.yml | 2 +- ...dvpack_dll_lolbas_in_non_standard_path.yml | 2 +- ...ecutor_exe_lolbas_in_non_standard_path.yml | 2 +- ...taller_exe_lolbas_in_non_standard_path.yml | 2 +- ...appvlp_exe_lolbas_in_non_standard_path.yml | 2 +- ...mpiler_exe_lolbas_in_non_standard_path.yml | 2 +- ...ies_at_exe_lolbas_in_non_standard_path.yml | 2 +- ...broker_exe_lolbas_in_non_standard_path.yml | 2 +- ...__windows_rundll32_comsvcs_memory_dump.yml | 6 +- ...sa___windows_script_host_spawn_msbuild.yml | 2 +- ...sa___windows_service_create_with_tscon.yml | 2 +- .../ssa___windows_wmiprvse_spawn_msbuild.yml | 2 +- 84 files changed, 219 insertions(+), 229 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index adab1ed38b..9903f219c8 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -38,7 +38,6 @@ class FindingReportObject(): kill_chain_phase_str = kill_chain_phase_str + '{"phase": "' + kill_chain_phase + '", "phase_id": ' + str(detection.tags.kill_chain_phases_id[kill_chain_phase]) + "}" if not i == (len(detection.tags.kill_chain_phases_id.keys()) - 1): kill_chain_phase_str = kill_chain_phase_str + ', ' - else: i = i + 1 kill_chain_phase_str = kill_chain_phase_str + ']' detection.tags.kill_chain_phases_str = kill_chain_phase_str diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index 88fa0d2926..feff052006 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -2,8 +2,8 @@ | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {{ detection.tags.evidence_str }}, - message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "{{ detection.name }} has been triggered on " + device_hostname + " by " + {{ actor_user_name }} + ".", + users = [{"name": {{ actor_user_name }}, "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = {{ detection.tags.analytics_story_str }}, diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index 6e7bac33b0..1333e0cc4d 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -33,7 +33,7 @@ class SplunkBABackend(TextQueryBackend): wildcard_single : ClassVar[str] = "%" add_escaped : ClassVar[str] = "\\" - re_expression : ClassVar[str] = "match_regex({field}, /(?i){regex}/)=true" + re_expression : ClassVar[str] = "match({field}, /(?i){regex}/)=true" re_escape_char : ClassVar[str] = "\\" re_escape : ClassVar[Tuple[str]] = ('"',) diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 6f48a9783c..a15d7db969 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -29,7 +29,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 60, impact_id = 4, - kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 0b70137bf5..f7a11a1e64 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -12,11 +12,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR - process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true + process_file_name="cmd.exe") AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match(process_cmd_line, /(?i)HKLM\\System/)=true + OR match(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match(process_cmd_line, /(?i)HKLM\\Security/)=true) + AND match(process_cmd_line, /(?i)save/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index d22cdf0e33..0409bf8692 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)deny/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 95309eb29a..58cca50220 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -17,9 +17,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") - OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, - /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT - process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" + OR (actor_process_file_name="java.exe" AND (NOT match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) + OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension"))) + AND process_file_name="cmd.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 8ce96a388c..c83e4beb96 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -29,7 +29,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, {"phase": "Delivery", "phase_id": 3}, {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, {"phase": "Delivery", "phase_id": 3}, {"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index efe053454f..d9955ec8f1 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)grant/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index f6ed4535d0..267ae722ad 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="attrib.exe" - AND match_regex(process_cmd_line, /(?i)/)=true + AND match(process_cmd_line, /(?i)/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index 614ee484b3..c65aa357c2 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -14,10 +14,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, - /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)S-1-1-0:/)=true + OR match(process_cmd_line, /(?i)SYSTEM:/)=true OR match(process_cmd_line, /(?i)everyone:/)=true) + AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index b7c405fe3b..9bc5e0595b 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -12,10 +12,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" - OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true - OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, - /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true - OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) + OR process_file_name="wscript.exe") AND (match(actor_process_file_name, /(?i)visio.exe/)=true + OR match(actor_process_file_name, /(?i)mspub.exe/)=true OR match(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match(actor_process_file_name, /(?i)excel.exe/)=true + OR match(actor_process_file_name, /(?i)winword.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index a7ccdc0862..75dd61648b 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -40,7 +40,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 60, impact_id = 4, - kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}, {"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 146de25876..d8a643e571 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -224,8 +224,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT - match_regex(process_file_path, /(?i)\\windows\\system32/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, + /(?i)\\windows\\system32/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 4600574ccf..39ed1afd93 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -11,11 +11,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, - /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, - /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line - LIKE "% cl %" AND process_file_name="wevtutil.exe" + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)powershell/)=true + OR match(process_cmd_line, /(?i)setup/)=true OR match(process_cmd_line, /(?i)application/)=true + OR match(process_cmd_line, /(?i)sysmon/)=true OR match(process_cmd_line, /(?i)system/)=true + OR match(process_cmd_line, /(?i)security/)=true) AND process_cmd_line LIKE "% cl + %" AND process_file_name="wevtutil.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index 089db07e18..49c0fe93cb 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -34,7 +34,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index aa092d4b52..ba36c8d543 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -36,7 +36,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index 713d4695a6..800a1bf3e2 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -16,7 +16,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, @@ -32,7 +32,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 80, impact_id = 5, - kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}, ], + kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 2299d662a5..5287852502 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -28,7 +28,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line - LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match(process_file_name, /(?i)curl.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 78c7754fd8..7b17a812d6 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -10,10 +10,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_file_name, - /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows - defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows - defender\\platform/)=true) + | eval device_hostname = device.hostname | where match(process_file_name, /(?i)mpcmdrun.exe/)=true + AND (NOT match(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match(process_file_path, + /(?i)\\microsoft\\windows defender\\platform/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index b68abc926b..e4bb5c82d3 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -14,41 +14,38 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_file_name, - /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true - OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, - /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true - OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, - /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true - OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, - /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true - OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, - /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true - OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, - /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true - OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, - /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, - /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true - OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true - OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, - /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true - OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, - /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true - OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR - match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR - match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, - /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true - OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true - OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, - /(?i)filehistory.exe/)=true OR match_regex(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) - AND (NOT (match_regex(process_file_path, /(?i)\\windows\\system32/)=true OR match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, /(?i)\\windows\\adws/)=true - OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path, - /(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true - OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) + | eval device_hostname = device.hostname | where (match(process_file_name, /(?i)MSBuild.exe/)=true + OR match(process_file_name, /(?i)comsvcconfig.exe/)=true OR match(process_file_name, + /(?i)dfsradmin.exe/)=true OR match(process_file_name, /(?i)dfsvc.exe/)=true OR match(process_file_name, + /(?i)microsoft.workflow.compiler.exe/)=true OR match(process_file_name, /(?i)smsvchost.exe/)=true + OR match(process_file_name, /(?i)wsatconfig.exe/)=true OR match(process_file_name, + /(?i)addinprocess.exe/)=true OR match(process_file_name, /(?i)addinprocess32.exe/)=true + OR match(process_file_name, /(?i)addinutil.exe/)=true OR match(process_file_name, + /(?i)aspnet_compiler.exe/)=true OR match(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true + OR match(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match(process_file_name, + /(?i)caspol.exe/)=true OR match(process_file_name, /(?i)datasvcutil.exe/)=true OR + match(process_file_name, /(?i)edmgen.exe/)=true OR match(process_file_name, /(?i)installutil.exe/)=true + OR match(process_file_name, /(?i)jsc.exe/)=true OR match(process_file_name, /(?i)ngentask.exe/)=true + OR match(process_file_name, /(?i)regasm.exe/)=true OR match(process_file_name, /(?i)regsvcs.exe/)=true + OR match(process_file_name, /(?i)sdnbr.exe/)=true OR match(process_file_name, /(?i)acu.exe/)=true + OR match(process_file_name, /(?i)appvstreamingux.exe/)=true OR match(process_file_name, + /(?i)dsac.exe/)=true OR match(process_file_name, /(?i)lbfoadmin.exe/)=true OR match(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match(process_file_name, /(?i)mtedit.exe/)=true + OR match(process_file_name, /(?i)scriptrunner.exe/)=true OR match(process_file_name, + /(?i)servermanager.exe/)=true OR match(process_file_name, /(?i)stordiag.exe/)=true + OR match(process_file_name, /(?i)tzsync.exe/)=true OR match(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true + OR match(process_file_name, /(?i)uevappmonitor.exe/)=true OR match(process_file_name, + /(?i)uevtemplatebaselinegenerator.exe/)=true OR match(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true + OR match(process_file_name, /(?i)powershell_ise.exe/)=true OR match(process_file_name, + /(?i)iediagcmd.exe/)=true OR match(process_file_name, /(?i)xbox.tcui.exe/)=true + OR match(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true + OR match(process_file_name, /(?i)iisual.exe/)=true OR match(process_file_name, /(?i)filehistory.exe/)=true + OR match(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) AND (NOT (match(process_file_path, + /(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)\\windows\\syswow64/)=true + OR match(process_file_path, /(?i)\\windows\\adws/)=true OR match(process_file_path, + /(?i)\\windows\\networkcontroller/)=true OR match(process_file_path, /(?i)\\windows\\systemapps/)=true + OR match(process_file_path, /(?i)\\winsxs/)=true OR match(process_file_path, /(?i)\\microsoft.net/)=true)) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 0824a99345..d9c189e641 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -27,14 +27,14 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true - OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true + | where match(process_cmd_line, /(?i)get-recipient/)=true OR match(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match(process_cmd_line, /(?i)new-mailboxexportrequest/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows Exchange PowerShell Module Usage has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["ProxyShell", "CISA AA22-264A"], diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index a48d72f991..f526a2f22f 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -16,9 +16,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") - AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, - /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) - AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true + AND (match(process_cmd_line, /(?i).xml/)=true OR match(process_cmd_line, /(?i)it_rebrowseforfile=/)=true + OR match(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match(process_cmd_line, + /(?i)pcwdiagnostic/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index 7fee533d55..b6b88bab5e 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -12,12 +12,12 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true + | where match(process_cmd_line, /(?i)invoke-sharefinder/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows File Share Discovery With Powerview has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Privilege Escalation"], diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index 0703ad6c87..52ce6106b5 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -43,11 +43,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe" OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe") - AND (NOT (match_regex(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR - match_regex(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, - /(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true - OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path, - /(?i)(?i)\\microsoft.net/)=true)) + AND (NOT (match(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR match(process_file_path, + /(?i)(?i)\\windows\\syswow64/)=true OR match(process_file_path, /(?i)(?i)\\windows\\networkcontrolle/)=true + OR match(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match(process_file_path, + /(?i)(?i)\\winsxs/)=true OR match(process_file_path, /(?i)(?i)\\microsoft.net/)=true)) + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 29a025ccae..80aa84648f 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index be4d210442..efa2c1a6cc 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -13,13 +13,13 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + | where process_cmd_line LIKE "%4194304%" AND match(process_cmd_line, /(?i)get-aduser/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Kerberos Attacks"], diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 7650d705bb..890e2266aa 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -13,13 +13,13 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + | where match(process_cmd_line, /(?i)preauthnotrequired/)=true AND match(process_cmd_line, /(?i)get-domainuser/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Kerberos Attacks"], diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index c188824b28..4a776ee071 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)downloadfile/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index 2500358d00..0799d0e078 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -17,7 +17,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)start-bitstransfer/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, @@ -33,7 +33,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}, ], + kill_chain = [{"phase": "Exploitation", "phase_id": 4}, {"phase": "Installation", "phase_id": 5}, {"phase": "Command And Control", "phase_id": 6}], nist = ["DE.AE"], risk_level = "Medium", category_uid = 2, diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index 4650b8e34f..e125074ebc 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -14,12 +14,12 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true + | where match(process_cmd_line, /(?i)get-gpppassword/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"device.hostname": device_hostname, "process.file.path": process_file_path, "process.uid": process_uid, "process.cmd_line": process_cmd_line, "actor.user.uid": actor_user_uid}, - message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + actor_user_name + ".", - users = [{"name": actor_user_name, "uid": actor_user.uid}], + message = "Windows PowerSploit GPP Discovery has been triggered on " + device_hostname + " by " + "Unknown" + ".", + users = [{"name": "Unknown", "uid": actor_user.uid}], activity_id = 1, cis_csc = [{"control": "CIS 10", "version": 8}], analytic_stories = ["Active Directory Privilege Escalation"], diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index a10ab76821..482f8ada17 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -13,8 +13,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" - AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, - /(?i)-d /)=true + AND match(process_cmd_line, /(?i)-p /)=true AND match(process_cmd_line, /(?i)-d + /)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 4a5cb5074e..740cf36319 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 01d1fcd8e8..16926bf393 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="adplus.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index cf08319b30..ff329e9c7e 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="advpack.dll" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 44237257b6..9914665f37 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index c62a22554f..af5b9998a4 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) + AND (NOT match(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 94e3af2f34..07aab07703 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index 260b51a3e3..8274df62be 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index b787c9dcfe..667b57e8c1 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="at.exe" AND - (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) + (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 5aa120d6d9..1d41516be8 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -13,7 +13,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index deb2cd7983..6922f72764 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -11,9 +11,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, - /(?i)comsvcs.dll/)=true + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)minidump/)=true + AND process_file_name="rundll32.exe") AND match(process_cmd_line, /(?i)comsvcs.dll/)=true + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 5492299cdf..6502f28f18 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + AND (match(actor_process_file_name, /(?i)cscript.exe/)=true OR match(actor_process_file_name, /(?i)wscript.exe/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 8968530a9a..9775f6b5d9 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -16,7 +16,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true + AND match(actor_process_file_name, /(?i)wmiprvse.exe/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 0c816a5a0a..c52dfa8ad6 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -18,11 +18,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="reg.exe" OR - process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true - OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(process_cmd_line, - /(?i)HKLM\\Security/)=true) AND match_regex(process_cmd_line, /(?i)save/)=true --finding_report--' + process_file_name="cmd.exe") AND (match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true + OR match(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match(process_cmd_line, + /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match(process_cmd_line, /(?i)HKLM\\System/)=true + OR match(process_cmd_line, /(?i)HKLM\\SAM/)=true OR match(process_cmd_line, /(?i)HKLM\\Security/)=true) + AND match(process_cmd_line, /(?i)save/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index b04c82576e..3bb94bc52e 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)deny/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 5e7e5f32b3..62afc13388 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -23,9 +23,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR actor_process_file_name="acrobat.exe" OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") - OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, - /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" AND (NOT - process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe" --finding_report--' + OR (actor_process_file_name="java.exe" AND (NOT match(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) + OR (actor_process_file_name="chrome.exe" AND (NOT process_cmd_line="chrome-extension"))) + AND process_file_name="cmd.exe" --finding_report--' how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 021a4a0d0a..f3b20295f2 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, + OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") AND match(process_cmd_line, /(?i)grant/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index d701cedbc0..c7a66d164b 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="attrib.exe" - AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--' + AND match(process_cmd_line, /(?i)/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index f5162ac060..96b99a50d0 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -20,10 +20,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, - /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" - OR process_file_name="cacls.exe") --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)S-1-1-0:/)=true + OR match(process_cmd_line, /(?i)SYSTEM:/)=true OR match(process_cmd_line, /(?i)everyone:/)=true) + AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index 434231093c..8f99a7f8fa 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -18,10 +18,10 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="cscript.exe" - OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true - OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, - /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true - OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true) --finding_report--' + OR process_file_name="wscript.exe") AND (match(actor_process_file_name, /(?i)visio.exe/)=true + OR match(actor_process_file_name, /(?i)mspub.exe/)=true OR match(actor_process_file_name, + /(?i)powerpnt.exe/)=true OR match(actor_process_file_name, /(?i)excel.exe/)=true + OR match(actor_process_file_name, /(?i)winword.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 7b8d39b06c..58e4a72061 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -230,8 +230,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT - match_regex(process_file_path, /(?i)\\windows\\system32/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, + /(?i)\\windows\\system32/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 70e72eda41..7924a16f66 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -17,11 +17,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, - /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, - /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND process_cmd_line - LIKE "% cl %" AND process_file_name="wevtutil.exe" --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)powershell/)=true + OR match(process_cmd_line, /(?i)setup/)=true OR match(process_cmd_line, /(?i)application/)=true + OR match(process_cmd_line, /(?i)sysmon/)=true OR match(process_cmd_line, /(?i)system/)=true + OR match(process_cmd_line, /(?i)security/)=true) AND process_cmd_line LIKE "% cl + %" AND process_file_name="wevtutil.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index c406297a5b..b2722a57f9 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -22,7 +22,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true + | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index b73a56ab71..67be892bf2 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -34,7 +34,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_cmd_line LIKE "%-F %" OR process_cmd_line LIKE "%--data %" OR process_cmd_line LIKE "%-d %" OR process_cmd_line - LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match_regex(process_file_name, + LIKE "%--upload-file %" OR process_cmd_line LIKE "%-T %") AND match(process_file_name, /(?i)curl.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index 9db25d56d3..97e3b5c5aa 100644 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -16,10 +16,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_file_name, - /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows - defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows - defender\\platform/)=true) --finding_report--' + | eval device_hostname = device.hostname | where match(process_file_name, /(?i)mpcmdrun.exe/)=true + AND (NOT match(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match(process_file_path, + /(?i)\\microsoft\\windows defender\\platform/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. references: diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index 1cb6c75f94..aa304945f6 100644 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -20,41 +20,38 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_file_name, - /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true - OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, - /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true - OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true OR match_regex(process_file_name, - /(?i)wsatconfig.exe/)=true OR match_regex(process_file_name, /(?i)addinprocess.exe/)=true - OR match_regex(process_file_name, /(?i)addinprocess32.exe/)=true OR match_regex(process_file_name, - /(?i)addinutil.exe/)=true OR match_regex(process_file_name, /(?i)aspnet_compiler.exe/)=true - OR match_regex(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true OR match_regex(process_file_name, - /(?i)aspnet_regsql.exe/)=true OR match_regex(process_file_name, /(?i)caspol.exe/)=true - OR match_regex(process_file_name, /(?i)datasvcutil.exe/)=true OR match_regex(process_file_name, - /(?i)edmgen.exe/)=true OR match_regex(process_file_name, /(?i)installutil.exe/)=true - OR match_regex(process_file_name, /(?i)jsc.exe/)=true OR match_regex(process_file_name, - /(?i)ngentask.exe/)=true OR match_regex(process_file_name, /(?i)regasm.exe/)=true - OR match_regex(process_file_name, /(?i)regsvcs.exe/)=true OR match_regex(process_file_name, - /(?i)sdnbr.exe/)=true OR match_regex(process_file_name, /(?i)acu.exe/)=true OR match_regex(process_file_name, - /(?i)appvstreamingux.exe/)=true OR match_regex(process_file_name, /(?i)dsac.exe/)=true - OR match_regex(process_file_name, /(?i)lbfoadmin.exe/)=true OR match_regex(process_file_name, - /(?i)microsoft.uev.synccontroller.exe/)=true OR match_regex(process_file_name, /(?i)mtedit.exe/)=true - OR match_regex(process_file_name, /(?i)scriptrunner.exe/)=true OR match_regex(process_file_name, - /(?i)servermanager.exe/)=true OR match_regex(process_file_name, /(?i)stordiag.exe/)=true - OR match_regex(process_file_name, /(?i)tzsync.exe/)=true OR match_regex(process_file_name, - /(?i)uevagentpolicygenerator.exe/)=true OR match_regex(process_file_name, /(?i)uevappmonitor.exe/)=true - OR match_regex(process_file_name, /(?i)uevtemplatebaselinegenerator.exe/)=true OR - match_regex(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true OR - match_regex(process_file_name, /(?i)powershell_ise.exe/)=true OR match_regex(process_file_name, - /(?i)iediagcmd.exe/)=true OR match_regex(process_file_name, /(?i)xbox.tcui.exe/)=true - OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true - OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name, - /(?i)filehistory.exe/)=true OR match_regex(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) - AND (NOT (match_regex(process_file_path, /(?i)\\windows\\system32/)=true OR match_regex(process_file_path, - /(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, /(?i)\\windows\\adws/)=true - OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path, - /(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true - OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) --finding_report--' + | eval device_hostname = device.hostname | where (match(process_file_name, /(?i)MSBuild.exe/)=true + OR match(process_file_name, /(?i)comsvcconfig.exe/)=true OR match(process_file_name, + /(?i)dfsradmin.exe/)=true OR match(process_file_name, /(?i)dfsvc.exe/)=true OR match(process_file_name, + /(?i)microsoft.workflow.compiler.exe/)=true OR match(process_file_name, /(?i)smsvchost.exe/)=true + OR match(process_file_name, /(?i)wsatconfig.exe/)=true OR match(process_file_name, + /(?i)addinprocess.exe/)=true OR match(process_file_name, /(?i)addinprocess32.exe/)=true + OR match(process_file_name, /(?i)addinutil.exe/)=true OR match(process_file_name, + /(?i)aspnet_compiler.exe/)=true OR match(process_file_name, /(?i)aspnet_regbrowsers.exe/)=true + OR match(process_file_name, /(?i)aspnet_regsql.exe/)=true OR match(process_file_name, + /(?i)caspol.exe/)=true OR match(process_file_name, /(?i)datasvcutil.exe/)=true OR + match(process_file_name, /(?i)edmgen.exe/)=true OR match(process_file_name, /(?i)installutil.exe/)=true + OR match(process_file_name, /(?i)jsc.exe/)=true OR match(process_file_name, /(?i)ngentask.exe/)=true + OR match(process_file_name, /(?i)regasm.exe/)=true OR match(process_file_name, /(?i)regsvcs.exe/)=true + OR match(process_file_name, /(?i)sdnbr.exe/)=true OR match(process_file_name, /(?i)acu.exe/)=true + OR match(process_file_name, /(?i)appvstreamingux.exe/)=true OR match(process_file_name, + /(?i)dsac.exe/)=true OR match(process_file_name, /(?i)lbfoadmin.exe/)=true OR match(process_file_name, + /(?i)microsoft.uev.synccontroller.exe/)=true OR match(process_file_name, /(?i)mtedit.exe/)=true + OR match(process_file_name, /(?i)scriptrunner.exe/)=true OR match(process_file_name, + /(?i)servermanager.exe/)=true OR match(process_file_name, /(?i)stordiag.exe/)=true + OR match(process_file_name, /(?i)tzsync.exe/)=true OR match(process_file_name, /(?i)uevagentpolicygenerator.exe/)=true + OR match(process_file_name, /(?i)uevappmonitor.exe/)=true OR match(process_file_name, + /(?i)uevtemplatebaselinegenerator.exe/)=true OR match(process_file_name, /(?i)uevtemplateconfigitemgenerator.exe/)=true + OR match(process_file_name, /(?i)powershell_ise.exe/)=true OR match(process_file_name, + /(?i)iediagcmd.exe/)=true OR match(process_file_name, /(?i)xbox.tcui.exe/)=true + OR match(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true + OR match(process_file_name, /(?i)iisual.exe/)=true OR match(process_file_name, /(?i)filehistory.exe/)=true + OR match(process_file_name, /(?i)secureassessmentbrowser.exe/)=true) AND (NOT (match(process_file_path, + /(?i)\\windows\\system32/)=true OR match(process_file_path, /(?i)\\windows\\syswow64/)=true + OR match(process_file_path, /(?i)\\windows\\adws/)=true OR match(process_file_path, + /(?i)\\windows\\networkcontroller/)=true OR match(process_file_path, /(?i)\\windows\\systemapps/)=true + OR match(process_file_path, /(?i)\\winsxs/)=true OR match(process_file_path, /(?i)\\microsoft.net/)=true)) + --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml index a3f7a5035e..ebeb2baa38 100644 --- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml @@ -33,9 +33,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true - OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' + | where match(process_cmd_line, /(?i)get-recipient/)=true OR match(process_cmd_line, + /(?i)new-mailboxsearch/)=true OR match(process_cmd_line, /(?i)new-managementroleassignment/)=true + OR match(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 07f0d4b0df..0af85436d8 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -22,9 +22,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where ((process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:-id%" OR process_cmd_line LIKE "%ms-msdt:/id%" OR process_cmd_line LIKE "%ms-msdt:%" OR process_cmd_line LIKE "%msdt%") AND process_file_name="msdt.exe") - AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, - /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) - AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true --finding_report--' + AND (match(process_cmd_line, /(?i).xml/)=true OR match(process_cmd_line, /(?i)it_rebrowseforfile=/)=true + OR match(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match(process_cmd_line, + /(?i)pcwdiagnostic/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml index c1efe0a14a..dc0a56c184 100644 --- a/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_file_share_discovery_with_powerview.yml @@ -18,7 +18,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)invoke-sharefinder/)=true --finding_report--' + | where match(process_cmd_line, /(?i)invoke-sharefinder/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index 007bd8d679..ccd9af5497 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -49,11 +49,11 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe" OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe") - AND (NOT (match_regex(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR - match_regex(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, - /(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true - OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path, - /(?i)(?i)\\microsoft.net/)=true)) --finding_report--' + AND (NOT (match(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR match(process_file_path, + /(?i)(?i)\\windows\\syswow64/)=true OR match(process_file_path, /(?i)(?i)\\windows\\networkcontrolle/)=true + OR match(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true OR match(process_file_path, + /(?i)(?i)\\winsxs/)=true OR match(process_file_path, /(?i)(?i)\\microsoft.net/)=true)) + --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 3d0a855c61..8b565f275c 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -25,7 +25,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index f56ba45e87..7e4dc440bf 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where process_cmd_line LIKE "%4194304%" AND match_regex(process_cmd_line, /(?i)get-aduser/)=true + | where process_cmd_line LIKE "%4194304%" AND match(process_cmd_line, /(?i)get-aduser/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index a3da967bc8..aac779b072 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, + | where match(process_cmd_line, /(?i)preauthnotrequired/)=true AND match(process_cmd_line, /(?i)get-domainuser/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 6bf321e9a0..4e7323720d 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -21,7 +21,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)downloadfile/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml index 7d4390f1d4..45f2fd5c76 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_certificate.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)export-certificate/)=true --finding_report--' + | where match(process_cmd_line, /(?i)export-certificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml index f4a7e2b33e..895cd59795 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_export_pfxcertificate.yml @@ -15,7 +15,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)export-pfxcertificate/)=true --finding_report--' + | where match(process_cmd_line, /(?i)export-pfxcertificate/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 7d5b4a4e21..d7c0e9641b 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -23,7 +23,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" - OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, + OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, /(?i)start-bitstransfer/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml index 4f7d937a0d..a6e373f9af 100644 --- a/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml +++ b/ssa_detections/endpoint/ssa___windows_powersploit_gpp_discovery.yml @@ -20,7 +20,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me eval device_hostname = device.hostname | eval process_file = process.file | eval process_file_path = process_file.path | eval process_uid = process.uid | eval process_cmd_line = process.cmd_line | eval actor_user = actor.user | eval actor_user_uid = actor_user.uid - | where match_regex(process_cmd_line, /(?i)get-gpppassword/)=true --finding_report--' + | where match(process_cmd_line, /(?i)get-gpppassword/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index fab57125a0..5b06e7fe22 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -19,8 +19,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="rasautou.exe" - AND match_regex(process_cmd_line, /(?i)-p /)=true AND match_regex(process_cmd_line, - /(?i)-d /)=true --finding_report--' + AND match(process_cmd_line, /(?i)-p /)=true AND match(process_cmd_line, /(?i)-d + /)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index 6002889d2d..74de00e694 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -18,9 +18,8 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)create/)=true OR match_regex(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" - --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)create/)=true + OR match(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 2f7f6fc4d5..8ddf0d7212 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="acccheckconsole.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 95c9c571aa..089394a343 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="adplus.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index e3f7d60f8b..396f7c09dd 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="advpack.dll" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index a8af25142f..3643a3c25a 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="agentexecutor.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\program files (x86)/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 1f1f8446fc..0344c095dd 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appinstaller.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) + AND (NOT match(process_file_path, /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index c13db65c31..865e257a60 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="appvlp.exe" - AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) + AND (NOT match(process_file_path, /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index a57ca72320..9d2b863ad1 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="aspnet_compiler.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) + AND (NOT match(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 58cb8ce16a..c7972db282 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="at.exe" AND - (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' + (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index ce2726da1a..a6e598f94c 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="atbroker.exe" - AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' + AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index f888aa997b..bc39ea7fcf 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -17,9 +17,9 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (match_regex(process_cmd_line, - /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, - /(?i)comsvcs.dll/)=true --finding_report--' + | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)minidump/)=true + AND process_file_name="rundll32.exe") AND match(process_cmd_line, /(?i)comsvcs.dll/)=true + --finding_report--' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index cdb9b2a5da..b5e78fe232 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -21,7 +21,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, + AND (match(actor_process_file_name, /(?i)cscript.exe/)=true OR match(actor_process_file_name, /(?i)wscript.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml index 0e8bfb1854..b303b0ddb8 100644 --- a/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml +++ b/ssa_detections/endpoint/ssa___windows_service_create_with_tscon.yml @@ -23,7 +23,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where match_regex(process_cmd_line, /(?i)/dest:rdp-tcp/)=true + | eval device_hostname = device.hostname | where match(process_cmd_line, /(?i)/dest:rdp-tcp/)=true AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index cc5fd105fd..f8a462ae4c 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -22,7 +22,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where process_file_name="MSBuild.exe" - AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' + AND match(actor_process_file_name, /(?i)wmiprvse.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From 54033069281cd3d8bdb983d643261c2ca002708b Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 9 Aug 2023 17:56:37 +0200 Subject: [PATCH 05/89] delete tmp folder --- ...ssa___anomalous_usage_of_archive_tools.yml | 99 ------------------- 1 file changed, 99 deletions(-) delete mode 100644 tmp/ssa___anomalous_usage_of_archive_tools.yml diff --git a/tmp/ssa___anomalous_usage_of_archive_tools.yml b/tmp/ssa___anomalous_usage_of_archive_tools.yml deleted file mode 100644 index 8a7dd6cc0c..0000000000 --- a/tmp/ssa___anomalous_usage_of_archive_tools.yml +++ /dev/null @@ -1,99 +0,0 @@ -name: Anomalous usage of Archive Tools -id: 63614a58-10e2-4c6c-ae81-ea1113681439 -version: 1 -date: '2021-11-22' -author: Patrick Bareiss, Splunk -type: Anomaly -status: production -description: The following detection identifies the usage of archive tools from the - command line. -data_source: -- Windows Security 4688 -search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | - eval process_pid = process.pid | eval process_file = process.file | eval process_file_path - = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line - = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name - | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid - | eval actor_process_file = actor_process.file | eval actor_process_file_path = - actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name IN ("WinRAR.exe", - "7z%", "winzip%")) AND (actor_process_file_name IN ("%powershell.exe", "%cmd.exe")) - --finding_report--' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: False positives can be ligitmate usage of archive tools from - the command line. -references: -- https://attack.mitre.org/techniques/T1560/001/ -tags: - analytic_story: - - Cobalt Strike - - NOBELIUM Group - - Insider Threat - asset_type: Endpoint - confidence: 60 - impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading - of 7zip. - mitre_attack_id: - - T1560.001 - - T1560 - observable: - - name: process.pid - type: Other - - name: process.file.path - type: File - - name: process.file.name - type: File - - name: process.cmd_line - type: Other - - name: actor.user.name - type: User Name - - name: actor.process.pid - type: Other - - name: actor.process.file.path - type: File Name - - name: actor.process.file.name - type: File Name - - name: device.hostname - type: Hostname - product: - - Splunk Behavioral Analytics - required_fields: - - process.pid - - process.file.path - - process.file.name - - process.cmd_line - - actor.user.name - - actor.process.pid - - actor.process.file.path - - actor.process.file.name - - device.hostname - risk_score: 42 - security_domain: endpoint - mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: actor.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - - ocsf: device.hostname - cim: dest -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log - source: WinEventLog:Security From e120a617b324e8e2b94703e1ef3ad04ee0e79579 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 10 Aug 2023 11:46:46 +0200 Subject: [PATCH 06/89] converted detections to SPL2 --- ...ocess_running_from_unexpected_location.yml | 324 ++++++------------ ...ocess_running_from_unexpected_location.yml | 324 ++++++------------ 2 files changed, 224 insertions(+), 424 deletions(-) diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index d8a643e571..52cf812123 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -14,218 +14,118 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" - OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" - OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" - OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" - OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" - OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" - OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" - OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" - OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" - OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" - OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" - OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" - OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" - OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" - OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" - OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" - OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" - OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" - OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" - OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" - OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" - OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" - OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" - OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" - OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" - OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" - OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" - OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" - OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" - OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe" - OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" - OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" - OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" - OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe" - OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" - OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" - OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" - OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" - OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe" - OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe" - OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" - OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" - OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" - OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" - OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" - OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" - OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" - OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe" - OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe" - OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe" - OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe" - OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe" - OR process_file_name="pcaui.exe" OR process_file_name="pcalua.exe" OR process_file_name="p2phost.exe" - OR process_file_name="osk.exe" OR process_file_name="openfiles.exe" OR process_file_name="omadmprc.exe" - OR process_file_name="omadmclient.exe" OR process_file_name="odbcconf.exe" OR process_file_name="odbcad32.exe" - OR process_file_name="ocsetup.exe" OR process_file_name="ntprint.exe" OR process_file_name="ntoskrnl.exe" - OR process_file_name="nslookup.exe" OR process_file_name="notepad.exe" OR process_file_name="nltest.exe" - OR process_file_name="newdev.exe" OR process_file_name="netsh.exe" OR process_file_name="netiougc.exe" - OR process_file_name="netcfg.exe" OR process_file_name="netbtugc.exe" OR process_file_name="net1.exe" - OR process_file_name="net.exe" OR process_file_name="ndadmin.exe" OR process_file_name="nbtstat.exe" - OR process_file_name="mtstocom.exe" OR process_file_name="mstsc.exe" OR process_file_name="msra.exe" - OR process_file_name="mspaint.exe" OR process_file_name="msinfo32.exe" OR process_file_name="msiexec.exe" - OR process_file_name="mshta.exe" OR process_file_name="msg.exe" OR process_file_name="msfeedssync.exe" - OR process_file_name="msdtc.exe" OR process_file_name="msdt.exe" OR process_file_name="msconfig.exe" - OR process_file_name="mpnotify.exe" OR process_file_name="mountvol.exe" OR process_file_name="mobsync.exe" - OR process_file_name="mmc.exe" OR process_file_name="mfpmp.exe" OR process_file_name="mctadmin.exe" - OR process_file_name="mcbuilder.exe" OR process_file_name="mblctr.exe" OR process_file_name="manage-bde.exe" - OR process_file_name="makecab.exe" OR process_file_name="lsm.exe" OR process_file_name="lsass.exe" - OR process_file_name="lpremove.exe" OR process_file_name="lpksetup.exe" OR process_file_name="lpkinstall.exe" - OR process_file_name="logoff.exe" OR process_file_name="logman.exe" OR process_file_name="logagent.exe" - OR process_file_name="lodctr.exe" OR process_file_name="licensingdiag.exe" OR process_file_name="label.exe" - OR process_file_name="ktmutil.exe" OR process_file_name="ksetup.exe" OR process_file_name="klist.exe" - OR process_file_name="isoburn.exe" OR process_file_name="iscsicpl.exe" OR process_file_name="iscsicli.exe" - OR process_file_name="irftp.exe" OR process_file_name="ipconfig.exe" OR process_file_name="immersivetpmvscmgrsvr.exe" - OR process_file_name="iexpress.exe" OR process_file_name="ieetwcollector.exe" OR - process_file_name="ieunatt.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="icsunattend.exe" - OR process_file_name="icardagt.exe" OR process_file_name="icacls.exe" OR process_file_name="hwrreg.exe" - OR process_file_name="hwrcomp.exe" OR process_file_name="help.exe" OR process_file_name="hdwwiz.exe" - OR process_file_name="grpconv.exe" OR process_file_name="gpupdate.exe" OR process_file_name="gpscript.exe" - OR process_file_name="gpresult.exe" OR process_file_name="getmac.exe" OR process_file_name="fveprompt.exe" - OR process_file_name="fvenotify.exe" OR process_file_name="ftp.exe" OR process_file_name="fsutil.exe" - OR process_file_name="fsquirt.exe" OR process_file_name="fsavailux.exe" OR process_file_name="forfiles.exe" - OR process_file_name="fontview.exe" OR process_file_name="fontdrvhost.exe" OR process_file_name="fodhelper.exe" - OR process_file_name="fltmc.exe" OR process_file_name="fixmapi.exe" OR process_file_name="finger.exe" - OR process_file_name="findstr.exe" OR process_file_name="find.exe" OR process_file_name="fhmanagew.exe" - OR process_file_name="fc.exe" OR process_file_name="extrac32.exe" OR process_file_name="expand.exe" - OR process_file_name="eventvwr.exe" OR process_file_name="eventcreate.exe" OR process_file_name="eudcedit.exe" - OR process_file_name="esentutl.exe" OR process_file_name="embeddedapplauncher.exe" - OR process_file_name="efsui.exe" OR process_file_name="easinvoker.exe" OR process_file_name="dxdiag.exe" - OR process_file_name="dwm.exe" OR process_file_name="dvdupgrd.exe" OR process_file_name="dvdplay.exe" - OR process_file_name="dstokenclean.exe" OR process_file_name="dsregcmd.exe" OR process_file_name="drvinst.exe" - OR process_file_name="drvcfg.exe" OR process_file_name="driverquery.exe" OR process_file_name="dpnsvr.exe" - OR process_file_name="dpapimig.exe" OR process_file_name="doskey.exe" OR process_file_name="dnscacheugc.exe" - OR process_file_name="dmclient.exe" OR process_file_name="dmcfghost.exe" OR process_file_name="dmcertinst.exe" - OR process_file_name="dllhst3g.exe" OR process_file_name="dllhost.exe" OR process_file_name="djoin.exe" - OR process_file_name="dispdiag.exe" OR process_file_name="diskraid.exe" OR process_file_name="diskperf.exe" - OR process_file_name="diskpart.exe" OR process_file_name="dinotify.exe" OR process_file_name="diantz.exe" - OR process_file_name="dialer.exe" OR process_file_name="dfrgui.exe" OR process_file_name="ddodiag.exe" - OR process_file_name="dcomcnfg.exe" OR process_file_name="dccw.exe" OR process_file_name="dashost.exe" - OR process_file_name="cttunesvr.exe" OR process_file_name="cttune.exe" OR process_file_name="ctfmon.exe" - OR process_file_name="csrss.exe" OR process_file_name="cscript.exe" OR process_file_name="credwiz.exe" - OR process_file_name="convert.exe" OR process_file_name="control.exe" OR process_file_name="consent.exe" - OR process_file_name="conhost.exe" OR process_file_name="compact.exe" OR process_file_name="comp.exe" - OR process_file_name="colorcpl.exe" OR process_file_name="cofire.exe" OR process_file_name="cmstp.exe" - OR process_file_name="cmmon32.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmd.exe" OR process_file_name="clip.exe" OR process_file_name="cliconfg.exe" - OR process_file_name="cleanmgr.exe" OR process_file_name="cipher.exe" OR process_file_name="choice.exe" - OR process_file_name="chkntfs.exe" OR process_file_name="chkdsk.exe" OR process_file_name="chgusr.exe" - OR process_file_name="chgport.exe" OR process_file_name="chglogon.exe" OR process_file_name="charmap.exe" - OR process_file_name="changepk.exe" OR process_file_name="change.exe" OR process_file_name="certutil.exe" - OR process_file_name="certreq.exe" OR process_file_name="cdpreference.exe" OR process_file_name="calc.exe" - OR process_file_name="cacls.exe" OR process_file_name="bthudtask.exe" OR process_file_name="browser_broker.exe" - OR process_file_name="bridgeunattend.exe" OR process_file_name="bootsect.exe" OR - process_file_name="bootim.exe" OR process_file_name="bootcfg.exe" OR process_file_name="bitsadmin.exe" - OR process_file_name="bdeunlock.exe" OR process_file_name="bdechangepin.exe" OR - process_file_name="bcdedit.exe" OR process_file_name="bcdboot.exe" OR process_file_name="bcastdvr.exe" - OR process_file_name="backgroundtaskhost.exe" OR process_file_name="baaupdate.exe" - OR process_file_name="autofmt.exe" OR process_file_name="autoconv.exe" OR process_file_name="autochk.exe" - OR process_file_name="auditpol.exe" OR process_file_name="audiodg.exe" OR process_file_name="attrib.exe" - OR process_file_name="at.exe" OR process_file_name="appidpolicyconverter.exe" OR - process_file_name="appidcertstorecheck.exe" OR process_file_name="alg.exe" OR process_file_name="aitstatic.exe" - OR process_file_name="aitagent.exe" OR process_file_name="acu.exe" OR process_file_name="wpcmon.exe" - OR process_file_name="workfolders.exe" OR process_file_name="windowsupdateelevatedinstaller.exe" - OR process_file_name="windowsanytimeupgradeui.exe" OR process_file_name="windowsanytimeupgraderesults.exe" - OR process_file_name="windowsanytimeupgrade.exe" OR process_file_name="windowsactiondialog.exe" - OR process_file_name="windows.media.backgroundplayback.exe" OR process_file_name="winsat.exe" - OR process_file_name="werfaultsecure.exe" OR process_file_name="werfault.exe" OR - process_file_name="webcache.exe" OR process_file_name="wallpaperhost.exe" OR process_file_name="wwahost.exe" - OR process_file_name="wudfhost.exe" OR process_file_name="wsreset.exe" OR process_file_name="wsmanhttpconfig.exe" - OR process_file_name="wscollect.exe" OR process_file_name="wpdshextautoplay.exe" - OR process_file_name="wmpdmc.exe" OR process_file_name="wfs.exe" OR process_file_name="vaultsysui.exe" - OR process_file_name="vaultcmd.exe" OR process_file_name="vssvc.exe" OR process_file_name="utilman.exe" - OR process_file_name="usoclient.exe" OR process_file_name="useraccountcontrolsettings.exe" - OR process_file_name="useraccountbroker.exe" OR process_file_name="upgraderesultsui.exe" - OR process_file_name="ui0detect.exe" OR process_file_name="tswpfwrp.exe" OR process_file_name="tpminit.exe" - OR process_file_name="tokenbrokercookies.exe" OR process_file_name="thumbnailextractionhost.exe" - OR process_file_name="taskmgr.exe" OR process_file_name="tapiunattend.exe" OR process_file_name="tswbprxy.exe" - OR process_file_name="tstheme.exe" OR process_file_name="tracert.exe" OR process_file_name="tcpsvcs.exe" - OR process_file_name="systemsettingsremovedevice.exe" OR process_file_name="systemsettingsbroker.exe" - OR process_file_name="systemsettingsadminflows.exe" OR process_file_name="systempropertiesremote.exe" - OR process_file_name="systempropertiesprotection.exe" OR process_file_name="systempropertiesperformance.exe" - OR process_file_name="systempropertieshardware.exe" OR process_file_name="systempropertiesdataexecutionprevention.exe" - OR process_file_name="systempropertiescomputername.exe" OR process_file_name="systempropertiesadvanced.exe" - OR process_file_name="sysreseterr.exe" OR process_file_name="synchost.exe" OR process_file_name="stikynot.exe" - OR process_file_name="srtasks.exe" OR process_file_name="sppextcomobj.exe" OR process_file_name="spaceagent.exe" - OR process_file_name="soundrecorder.exe" OR process_file_name="snippingtool.exe" - OR process_file_name="sndvol.exe" OR process_file_name="smartscreensettings.exe" - OR process_file_name="slidetoshutdown.exe" OR process_file_name="settingsynchost.exe" - OR process_file_name="setieinstalleddate.exe" OR process_file_name="sensordataservice.exe" - OR process_file_name="secedit.exe" OR process_file_name="searchprotocolhost.exe" - OR process_file_name="searchindexer.exe" OR process_file_name="searchfilterhost.exe" - OR process_file_name="sihclient.exe" OR process_file_name="runtimebroker.exe" OR - process_file_name="runlegacycplelevated.exe" OR process_file_name="rpcping.exe" - OR process_file_name="rmclient.exe" OR process_file_name="remoteposworker.exe" OR - process_file_name="relpost.exe" OR process_file_name="registeriepkeys.exe" OR process_file_name="register-cimprovider.exe" - OR process_file_name="recoverydrive.exe" OR process_file_name="reagentc.exe" OR - process_file_name="rdpsauachelper.exe" OR process_file_name="rdpsaproxy.exe" OR - process_file_name="rdpsa.exe" OR process_file_name="route.exe" OR process_file_name="rmactivate_ssp_isv.exe" - OR process_file_name="rmactivate_ssp.exe" OR process_file_name="rmactivate_isv.exe" - OR process_file_name="rmactivate.exe" OR process_file_name="rdspnf.exe" OR process_file_name="proximityuxhost.exe" - OR process_file_name="printisolationhost.exe" OR process_file_name="printdialoghost3d.exe" - OR process_file_name="printdialoghost.exe" OR process_file_name="printbrmui.exe" - OR process_file_name="presentationsettings.exe" OR process_file_name="presentationhost.exe" - OR process_file_name="pnputil.exe" OR process_file_name="pnpunattend.exe" OR process_file_name="pkgmgr.exe" - OR process_file_name="pickerhost.exe" OR process_file_name="passwordonwakesettingflyout.exe" - OR process_file_name="ping.exe" OR process_file_name="pathping.exe" OR process_file_name="optionalfeatures.exe" - OR process_file_name="openwith.exe" OR process_file_name="networkuxbroker.exe" OR - process_file_name="netplwiz.exe" OR process_file_name="netproj.exe" OR process_file_name="netevtfwdr.exe" - OR process_file_name="netcfgnotifyobjecthost.exe" OR process_file_name="narrator.exe" - OR process_file_name="netstat.exe" OR process_file_name="napstat.exe" OR process_file_name="musnotificationux.exe" - OR process_file_name="musnotification.exe" OR process_file_name="multidigimon.exe" - OR process_file_name="muiunattend.exe" OR process_file_name="msspellcheckinghost.exe" - OR process_file_name="mpsigstub.exe" OR process_file_name="migautoplay.exe" OR process_file_name="mdsched.exe" - OR process_file_name="mdres.exe" OR process_file_name="mbaeparsertask.exe" OR process_file_name="magnify.exe" - OR process_file_name="mschedexe.exe" OR process_file_name="mrt.exe" OR process_file_name="mrinfo.exe" - OR process_file_name="mdmappinstaller.exe" OR process_file_name="mdmagent.exe" OR - process_file_name="mdeserver.exe" OR process_file_name="lsaiso.exe" OR process_file_name="logonui.exe" - OR process_file_name="lockscreencontentserver.exe" OR process_file_name="lockapphost.exe" - OR process_file_name="locator.exe" OR process_file_name="locationnotifications.exe" - OR process_file_name="locationnotificationwindows.exe" OR process_file_name="licensingui.exe" - OR process_file_name="licensemanagershellext.exe" OR process_file_name="legacynetuxhost.exe" - OR process_file_name="launchwinapp.exe" OR process_file_name="launchtm.exe" OR process_file_name="languagecomponentsinstallercomhandler.exe" - OR process_file_name="installagent.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="icsentitlementhost.exe" OR process_file_name="hostname.exe" - OR process_file_name="gettingstarted.exe" OR process_file_name="genvalobj.exe" OR - process_file_name="gamepanel.exe" OR process_file_name="fondue.exe" OR process_file_name="filehistory.exe" - OR process_file_name="fxsunatd.exe" OR process_file_name="fxssvc.exe" OR process_file_name="fxscover.exe" - OR process_file_name="ehstorauthn.exe" OR process_file_name="easeofaccessdialog.exe" - OR process_file_name="easpoliciesbrokerhost.exe" OR process_file_name="eap3host.exe" - OR process_file_name="eosnotify.exe" OR process_file_name="edpcleanup.exe" OR process_file_name="dxpserver.exe" - OR process_file_name="dsmusertask.exe" OR process_file_name="dpiscaling.exe" OR - process_file_name="dmomacpmo.exe" OR process_file_name="dmnotificationbroker.exe" - OR process_file_name="displayswitch.exe" OR process_file_name="dism.exe" OR process_file_name="disksnapshot.exe" - OR process_file_name="deviceproperties.exe" OR process_file_name="devicepairingwizard.exe" - OR process_file_name="deviceenroller.exe" OR process_file_name="deviceeject.exe" - OR process_file_name="devicedisplayobjectprovider.exe" OR process_file_name="defrag.exe" - OR process_file_name="dataexchangehost.exe" OR process_file_name="dwwin.exe" OR - process_file_name="dfdwiz.exe" OR process_file_name="credentialuibroker.exe" OR - process_file_name="computerdefaults.exe" OR process_file_name="compattelrunner.exe" - OR process_file_name="compmgmtlauncher.exe" OR process_file_name="cloudstoragewizard.exe" - OR process_file_name="cloudnotifications.exe" OR process_file_name="cloudexperiencehostbroker.exe" - OR process_file_name="clipup.exe" OR process_file_name="checknetisolation.exe" OR - process_file_name="certenrollctrl.exe" OR process_file_name="castsrv.exe" OR process_file_name="camerasettingsuihost.exe" - OR process_file_name="bytecodegenerator.exe" OR process_file_name="bitlockerwizardelev.exe" - OR process_file_name="bitlockerwizard.exe" OR process_file_name="bitlockerdeviceencryption.exe" - OR process_file_name="bdeunlockwizard.exe" OR process_file_name="bdeuisrv.exe" OR - process_file_name="bdehdcfg.exe" OR process_file_name="backgroundtransferhost.exe" - OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR - process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" - OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, - /(?i)\\windows\\system32/)=true) + | eval device_hostname = device.hostname | where (process_file_name IN ("xwizard.exe", + "xpsrchvw.exe", "xcopy.exe", "wusa.exe", "wuauclt.exe", "wuapp.exe", "wuapihost.exe", + "wsqmcons.exe", "wsmprovhost.exe", "wscript.exe", "write.exe", "wpr.exe", "wpnpinst.exe", + "wowreg32.exe", "wlrmdr.exe", "wlanext.exe", "wksprt.exe", "wkspbroker.exe", "wisptis.exe", + "winver.exe", "winrshost.exe", "winrs.exe", "winresume.exe", "winlogon.exe", "winload.exe", + "wininit.exe", "wimserv.exe", "wifitask.exe", "wiawow64.exe", "wiaacmgr.exe", "whoami.exe", + "where.exe", "wextract.exe", "wevtutil.exe", "wermgr.exe", "wecutil.exe", "wbengine.exe", + "wbadmin.exe", "waitfor.exe", "w32tm.exe", "vssadmin.exe", "vmicsvc.exe", "verifiergui.exe", + "verifier.exe", "verclsid.exe", "vdsldr.exe", "vds.exe", "userinit.exe", "upnpcont.exe", + "unregmp2.exe", "unlodctr.exe", "ucsvc.exe", "tzutil.exe", "tzsync.exe", "typeperf.exe", + "tskill.exe", "tsdiscon.exe", "tscon.exe", "tracerpt.exe", "tpmvscmgrsvr.exe", "tpmvscmgr.exe", + "timeout.exe", "tcmsetup.exe", "taskmgr.exe", "tasklist.exe", "taskkill.exe", "taskhostw.exe", + "taskhost.exe", "taskeng.exe", "takeown.exe", "tabcal.exe", "systray.exe", "systemreset.exe", + "systeminfo.exe", "syskey.exe", "sxstrace.exe", "svchost.exe", "subst.exe", "srdelayed.exe", + "spreview.exe", "sppsvc.exe", "spoolsv.exe", "spinstall.exe", "sort.exe", "snmptrap.exe", + "smss.exe", "slui.exe", "sihost.exe", "sigverif.exe", "shutdown.exe", "shrpubw.exe", + "shadow.exe", "setx.exe", "setupugc.exe", "setupcl.exe", "setspn.exe", "sethc.exe", + "sessionmsg.exe", "services.exe", "secinit.exe", "sdiagnhost.exe", "sdclt.exe", + "sdchange.exe", "sdbinst.exe", "schtasks.exe", "sc.exe", "sbunattend.exe", "rwinsta.exe", + "runonce.exe", "rundll32.exe", "runas.exe", "rstrui.exe", "rrinstaller.exe", "rmttpmvscmgrsvr.exe", + "resmon.exe", "reset.exe", "replace.exe", "repair-bde.exe", "relog.exe", "rekeywiz.exe", + "regsvr32.exe", "regini.exe", "regedt32.exe", "reg.exe", "recover.exe", "recdisc.exe", + "rdrleakdiag.exe", "rdpinput.exe", "rdpclip.exe", "rasphone.exe", "raserver.exe", + "rasdial.exe", "rasautou.exe", "qwinsta.exe", "quser.exe", "query.exe", "qprocess.exe", + "qappsrv.exe", "pwlauncher.exe", "psr.exe", "provtool.exe", "proquota.exe", "printui.exe", + "printfilterpipelinesvc.exe", "print.exe", "prevhost.exe", "powercfg.exe", "poqexec.exe", + "plasrv.exe", "phoneactivate.exe", "perfmon.exe", "pcwrun.exe", "pcawrk.exe", "pcaui.exe", + "pcalua.exe", "p2phost.exe", "osk.exe", "openfiles.exe", "omadmprc.exe", "omadmclient.exe", + "odbcconf.exe", "odbcad32.exe", "ocsetup.exe", "ntprint.exe", "ntoskrnl.exe", "nslookup.exe", + "notepad.exe", "nltest.exe", "newdev.exe", "netsh.exe", "netiougc.exe", "netcfg.exe", + "netbtugc.exe", "net1.exe", "net.exe", "ndadmin.exe", "nbtstat.exe", "mtstocom.exe", + "mstsc.exe", "msra.exe", "mspaint.exe", "msinfo32.exe", "msiexec.exe", "mshta.exe", + "msg.exe", "msfeedssync.exe", "msdtc.exe", "msdt.exe", "msconfig.exe", "mpnotify.exe", + "mountvol.exe", "mobsync.exe", "mmc.exe", "mfpmp.exe", "mctadmin.exe", "mcbuilder.exe", + "mblctr.exe", "manage-bde.exe", "makecab.exe", "lsm.exe", "lsass.exe", "lpremove.exe", + "lpksetup.exe", "lpkinstall.exe", "logoff.exe", "logman.exe", "logagent.exe", "lodctr.exe", + "licensingdiag.exe", "label.exe", "ktmutil.exe", "ksetup.exe", "klist.exe", "isoburn.exe", + "iscsicpl.exe", "iscsicli.exe", "irftp.exe", "ipconfig.exe", "immersivetpmvscmgrsvr.exe", + "iexpress.exe", "ieetwcollector.exe", "ieunatt.exe", "ie4uinit.exe", "icsunattend.exe", + "icardagt.exe", "icacls.exe", "hwrreg.exe", "hwrcomp.exe", "help.exe", "hdwwiz.exe", + "grpconv.exe", "gpupdate.exe", "gpscript.exe", "gpresult.exe", "getmac.exe", "fveprompt.exe", + "fvenotify.exe", "ftp.exe", "fsutil.exe", "fsquirt.exe", "fsavailux.exe", "forfiles.exe", + "fontview.exe", "fontdrvhost.exe", "fodhelper.exe", "fltmc.exe", "fixmapi.exe", + "finger.exe", "findstr.exe", "find.exe", "fhmanagew.exe", "fc.exe", "extrac32.exe", + "expand.exe", "eventvwr.exe", "eventcreate.exe", "eudcedit.exe", "esentutl.exe", + "embeddedapplauncher.exe", "efsui.exe", "easinvoker.exe", "dxdiag.exe", "dwm.exe", + "dvdupgrd.exe", "dvdplay.exe", "dstokenclean.exe", "dsregcmd.exe", "drvinst.exe", + "drvcfg.exe", "driverquery.exe", "dpnsvr.exe", "dpapimig.exe", "doskey.exe", "dnscacheugc.exe", + "dmclient.exe", "dmcfghost.exe", "dmcertinst.exe", "dllhst3g.exe", "dllhost.exe", + "djoin.exe", "dispdiag.exe", "diskraid.exe", "diskperf.exe", "diskpart.exe", "dinotify.exe", + "diantz.exe", "dialer.exe", "dfrgui.exe", "ddodiag.exe", "dcomcnfg.exe", "dccw.exe", + "dashost.exe", "cttunesvr.exe", "cttune.exe", "ctfmon.exe", "csrss.exe", "cscript.exe", + "credwiz.exe", "convert.exe", "control.exe", "consent.exe", "conhost.exe", "compact.exe", + "comp.exe", "colorcpl.exe", "cofire.exe", "cmstp.exe", "cmmon32.exe", "cmdl32.exe", + "cmdkey.exe", "cmd.exe", "clip.exe", "cliconfg.exe", "cleanmgr.exe", "cipher.exe", + "choice.exe", "chkntfs.exe", "chkdsk.exe", "chgusr.exe", "chgport.exe", "chglogon.exe", + "charmap.exe", "changepk.exe", "change.exe", "certutil.exe", "certreq.exe", "cdpreference.exe", + "calc.exe", "cacls.exe", "bthudtask.exe", "browser_broker.exe", "bridgeunattend.exe", + "bootsect.exe", "bootim.exe", "bootcfg.exe", "bitsadmin.exe", "bdeunlock.exe", "bdechangepin.exe", + "bcdedit.exe", "bcdboot.exe", "bcastdvr.exe", "backgroundtaskhost.exe", "baaupdate.exe", + "autofmt.exe", "autoconv.exe", "autochk.exe", "auditpol.exe", "audiodg.exe", "attrib.exe", + "at.exe", "appidpolicyconverter.exe", "appidcertstorecheck.exe", "alg.exe", "aitstatic.exe", + "aitagent.exe", "acu.exe", "wpcmon.exe", "workfolders.exe", "windowsupdateelevatedinstaller.exe", + "windowsanytimeupgradeui.exe", "windowsanytimeupgraderesults.exe", "windowsanytimeupgrade.exe", + "windowsactiondialog.exe", "windows.media.backgroundplayback.exe", "winsat.exe", + "werfaultsecure.exe", "werfault.exe", "webcache.exe", "wallpaperhost.exe", "wwahost.exe", + "wudfhost.exe", "wsreset.exe", "wsmanhttpconfig.exe", "wscollect.exe", "wpdshextautoplay.exe", + "wmpdmc.exe", "wfs.exe", "vaultsysui.exe", "vaultcmd.exe", "vssvc.exe", "utilman.exe", + "usoclient.exe", "useraccountcontrolsettings.exe", "useraccountbroker.exe", "upgraderesultsui.exe", + "ui0detect.exe", "tswpfwrp.exe", "tpminit.exe", "tokenbrokercookies.exe", "thumbnailextractionhost.exe", + "taskmgr.exe", "tapiunattend.exe", "tswbprxy.exe", "tstheme.exe", "tracert.exe", + "tcpsvcs.exe", "systemsettingsremovedevice.exe", "systemsettingsbroker.exe", "systemsettingsadminflows.exe", + "systempropertiesremote.exe", "systempropertiesprotection.exe", "systempropertiesperformance.exe", + "systempropertieshardware.exe", "systempropertiesdataexecutionprevention.exe", "systempropertiescomputername.exe", + "systempropertiesadvanced.exe", "sysreseterr.exe", "synchost.exe", "stikynot.exe", + "srtasks.exe", "sppextcomobj.exe", "spaceagent.exe", "soundrecorder.exe", "snippingtool.exe", + "sndvol.exe", "smartscreensettings.exe", "slidetoshutdown.exe", "settingsynchost.exe", + "setieinstalleddate.exe", "sensordataservice.exe", "secedit.exe", "searchprotocolhost.exe", + "searchindexer.exe", "searchfilterhost.exe", "sihclient.exe", "runtimebroker.exe", + "runlegacycplelevated.exe", "rpcping.exe", "rmclient.exe", "remoteposworker.exe", + "relpost.exe", "registeriepkeys.exe", "register-cimprovider.exe", "recoverydrive.exe", + "reagentc.exe", "rdpsauachelper.exe", "rdpsaproxy.exe", "rdpsa.exe", "route.exe", + "rmactivate_ssp_isv.exe", "rmactivate_ssp.exe", "rmactivate_isv.exe", "rmactivate.exe", + "rdspnf.exe", "proximityuxhost.exe", "printisolationhost.exe", "printdialoghost3d.exe", + "printdialoghost.exe", "printbrmui.exe", "presentationsettings.exe", "presentationhost.exe", + "pnputil.exe", "pnpunattend.exe", "pkgmgr.exe", "pickerhost.exe", "passwordonwakesettingflyout.exe", + "ping.exe", "pathping.exe", "optionalfeatures.exe", "openwith.exe", "networkuxbroker.exe", + "netplwiz.exe", "netproj.exe", "netevtfwdr.exe", "netcfgnotifyobjecthost.exe", "narrator.exe", + "netstat.exe", "napstat.exe", "musnotificationux.exe", "musnotification.exe", "multidigimon.exe", + "muiunattend.exe", "msspellcheckinghost.exe", "mpsigstub.exe", "migautoplay.exe", + "mdsched.exe", "mdres.exe", "mbaeparsertask.exe", "magnify.exe", "mschedexe.exe", + "mrt.exe", "mrinfo.exe", "mdmappinstaller.exe", "mdmagent.exe", "mdeserver.exe", + "lsaiso.exe", "logonui.exe", "lockscreencontentserver.exe", "lockapphost.exe", "locator.exe", + "locationnotifications.exe", "locationnotificationwindows.exe", "licensingui.exe", + "licensemanagershellext.exe", "legacynetuxhost.exe", "launchwinapp.exe", "launchtm.exe", + "languagecomponentsinstallercomhandler.exe", "installagent.exe", "infdefaultinstall.exe", + "icsentitlementhost.exe", "hostname.exe", "gettingstarted.exe", "genvalobj.exe", + "gamepanel.exe", "fondue.exe", "filehistory.exe", "fxsunatd.exe", "fxssvc.exe", + "fxscover.exe", "ehstorauthn.exe", "easeofaccessdialog.exe", "easpoliciesbrokerhost.exe", + "eap3host.exe", "eosnotify.exe", "edpcleanup.exe", "dxpserver.exe", "dsmusertask.exe", + "dpiscaling.exe", "dmomacpmo.exe", "dmnotificationbroker.exe", "displayswitch.exe", + "dism.exe", "disksnapshot.exe", "deviceproperties.exe", "devicepairingwizard.exe", + "deviceenroller.exe", "deviceeject.exe", "devicedisplayobjectprovider.exe", "defrag.exe", + "dataexchangehost.exe", "dwwin.exe", "dfdwiz.exe", "credentialuibroker.exe", "computerdefaults.exe", + "compattelrunner.exe", "compmgmtlauncher.exe", "cloudstoragewizard.exe", "cloudnotifications.exe", + "cloudexperiencehostbroker.exe", "clipup.exe", "checknetisolation.exe", "certenrollctrl.exe", + "castsrv.exe", "camerasettingsuihost.exe", "bytecodegenerator.exe", "bitlockerwizardelev.exe", + "bitlockerwizard.exe", "bitlockerdeviceencryption.exe", "bdeunlockwizard.exe", "bdeuisrv.exe", + "bdehdcfg.exe", "backgroundtransferhost.exe", "axinstui.exe", "autoworkplace.exe", + "authhost.exe", "atbroker.exe", "applicationframehost.exe", "adaptertroubleshooter.exe", + "arp.exe")) AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND + (NOT match(process_file_path, /(?i)\\windows\\system32/)=true) | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 58e4a72061..0246d7e2d6 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -20,218 +20,118 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name - | eval device_hostname = device.hostname | where (process_file_name="xwizard.exe" - OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" - OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" - OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" - OR process_file_name="write.exe" OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" - OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" - OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" - OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" - OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" - OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" - OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" - OR process_file_name="where.exe" OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" - OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" - OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" - OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" - OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" - OR process_file_name="vds.exe" OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" - OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" - OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" - OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" - OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" - OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" - OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" - OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" - OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" - OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" - OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" - OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" - OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" - OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe" - OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" - OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" - OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" - OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe" - OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" - OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" - OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" - OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" - OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe" - OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe" - OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" - OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" - OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" - OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" - OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" - OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" - OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" - OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe" - OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe" - OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe" - OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe" - OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe" - OR process_file_name="pcaui.exe" OR process_file_name="pcalua.exe" OR process_file_name="p2phost.exe" - OR process_file_name="osk.exe" OR process_file_name="openfiles.exe" OR process_file_name="omadmprc.exe" - OR process_file_name="omadmclient.exe" OR process_file_name="odbcconf.exe" OR process_file_name="odbcad32.exe" - OR process_file_name="ocsetup.exe" OR process_file_name="ntprint.exe" OR process_file_name="ntoskrnl.exe" - OR process_file_name="nslookup.exe" OR process_file_name="notepad.exe" OR process_file_name="nltest.exe" - OR process_file_name="newdev.exe" OR process_file_name="netsh.exe" OR process_file_name="netiougc.exe" - OR process_file_name="netcfg.exe" OR process_file_name="netbtugc.exe" OR process_file_name="net1.exe" - OR process_file_name="net.exe" OR process_file_name="ndadmin.exe" OR process_file_name="nbtstat.exe" - OR process_file_name="mtstocom.exe" OR process_file_name="mstsc.exe" OR process_file_name="msra.exe" - OR process_file_name="mspaint.exe" OR process_file_name="msinfo32.exe" OR process_file_name="msiexec.exe" - OR process_file_name="mshta.exe" OR process_file_name="msg.exe" OR process_file_name="msfeedssync.exe" - OR process_file_name="msdtc.exe" OR process_file_name="msdt.exe" OR process_file_name="msconfig.exe" - OR process_file_name="mpnotify.exe" OR process_file_name="mountvol.exe" OR process_file_name="mobsync.exe" - OR process_file_name="mmc.exe" OR process_file_name="mfpmp.exe" OR process_file_name="mctadmin.exe" - OR process_file_name="mcbuilder.exe" OR process_file_name="mblctr.exe" OR process_file_name="manage-bde.exe" - OR process_file_name="makecab.exe" OR process_file_name="lsm.exe" OR process_file_name="lsass.exe" - OR process_file_name="lpremove.exe" OR process_file_name="lpksetup.exe" OR process_file_name="lpkinstall.exe" - OR process_file_name="logoff.exe" OR process_file_name="logman.exe" OR process_file_name="logagent.exe" - OR process_file_name="lodctr.exe" OR process_file_name="licensingdiag.exe" OR process_file_name="label.exe" - OR process_file_name="ktmutil.exe" OR process_file_name="ksetup.exe" OR process_file_name="klist.exe" - OR process_file_name="isoburn.exe" OR process_file_name="iscsicpl.exe" OR process_file_name="iscsicli.exe" - OR process_file_name="irftp.exe" OR process_file_name="ipconfig.exe" OR process_file_name="immersivetpmvscmgrsvr.exe" - OR process_file_name="iexpress.exe" OR process_file_name="ieetwcollector.exe" OR - process_file_name="ieunatt.exe" OR process_file_name="ie4uinit.exe" OR process_file_name="icsunattend.exe" - OR process_file_name="icardagt.exe" OR process_file_name="icacls.exe" OR process_file_name="hwrreg.exe" - OR process_file_name="hwrcomp.exe" OR process_file_name="help.exe" OR process_file_name="hdwwiz.exe" - OR process_file_name="grpconv.exe" OR process_file_name="gpupdate.exe" OR process_file_name="gpscript.exe" - OR process_file_name="gpresult.exe" OR process_file_name="getmac.exe" OR process_file_name="fveprompt.exe" - OR process_file_name="fvenotify.exe" OR process_file_name="ftp.exe" OR process_file_name="fsutil.exe" - OR process_file_name="fsquirt.exe" OR process_file_name="fsavailux.exe" OR process_file_name="forfiles.exe" - OR process_file_name="fontview.exe" OR process_file_name="fontdrvhost.exe" OR process_file_name="fodhelper.exe" - OR process_file_name="fltmc.exe" OR process_file_name="fixmapi.exe" OR process_file_name="finger.exe" - OR process_file_name="findstr.exe" OR process_file_name="find.exe" OR process_file_name="fhmanagew.exe" - OR process_file_name="fc.exe" OR process_file_name="extrac32.exe" OR process_file_name="expand.exe" - OR process_file_name="eventvwr.exe" OR process_file_name="eventcreate.exe" OR process_file_name="eudcedit.exe" - OR process_file_name="esentutl.exe" OR process_file_name="embeddedapplauncher.exe" - OR process_file_name="efsui.exe" OR process_file_name="easinvoker.exe" OR process_file_name="dxdiag.exe" - OR process_file_name="dwm.exe" OR process_file_name="dvdupgrd.exe" OR process_file_name="dvdplay.exe" - OR process_file_name="dstokenclean.exe" OR process_file_name="dsregcmd.exe" OR process_file_name="drvinst.exe" - OR process_file_name="drvcfg.exe" OR process_file_name="driverquery.exe" OR process_file_name="dpnsvr.exe" - OR process_file_name="dpapimig.exe" OR process_file_name="doskey.exe" OR process_file_name="dnscacheugc.exe" - OR process_file_name="dmclient.exe" OR process_file_name="dmcfghost.exe" OR process_file_name="dmcertinst.exe" - OR process_file_name="dllhst3g.exe" OR process_file_name="dllhost.exe" OR process_file_name="djoin.exe" - OR process_file_name="dispdiag.exe" OR process_file_name="diskraid.exe" OR process_file_name="diskperf.exe" - OR process_file_name="diskpart.exe" OR process_file_name="dinotify.exe" OR process_file_name="diantz.exe" - OR process_file_name="dialer.exe" OR process_file_name="dfrgui.exe" OR process_file_name="ddodiag.exe" - OR process_file_name="dcomcnfg.exe" OR process_file_name="dccw.exe" OR process_file_name="dashost.exe" - OR process_file_name="cttunesvr.exe" OR process_file_name="cttune.exe" OR process_file_name="ctfmon.exe" - OR process_file_name="csrss.exe" OR process_file_name="cscript.exe" OR process_file_name="credwiz.exe" - OR process_file_name="convert.exe" OR process_file_name="control.exe" OR process_file_name="consent.exe" - OR process_file_name="conhost.exe" OR process_file_name="compact.exe" OR process_file_name="comp.exe" - OR process_file_name="colorcpl.exe" OR process_file_name="cofire.exe" OR process_file_name="cmstp.exe" - OR process_file_name="cmmon32.exe" OR process_file_name="cmdl32.exe" OR process_file_name="cmdkey.exe" - OR process_file_name="cmd.exe" OR process_file_name="clip.exe" OR process_file_name="cliconfg.exe" - OR process_file_name="cleanmgr.exe" OR process_file_name="cipher.exe" OR process_file_name="choice.exe" - OR process_file_name="chkntfs.exe" OR process_file_name="chkdsk.exe" OR process_file_name="chgusr.exe" - OR process_file_name="chgport.exe" OR process_file_name="chglogon.exe" OR process_file_name="charmap.exe" - OR process_file_name="changepk.exe" OR process_file_name="change.exe" OR process_file_name="certutil.exe" - OR process_file_name="certreq.exe" OR process_file_name="cdpreference.exe" OR process_file_name="calc.exe" - OR process_file_name="cacls.exe" OR process_file_name="bthudtask.exe" OR process_file_name="browser_broker.exe" - OR process_file_name="bridgeunattend.exe" OR process_file_name="bootsect.exe" OR - process_file_name="bootim.exe" OR process_file_name="bootcfg.exe" OR process_file_name="bitsadmin.exe" - OR process_file_name="bdeunlock.exe" OR process_file_name="bdechangepin.exe" OR - process_file_name="bcdedit.exe" OR process_file_name="bcdboot.exe" OR process_file_name="bcastdvr.exe" - OR process_file_name="backgroundtaskhost.exe" OR process_file_name="baaupdate.exe" - OR process_file_name="autofmt.exe" OR process_file_name="autoconv.exe" OR process_file_name="autochk.exe" - OR process_file_name="auditpol.exe" OR process_file_name="audiodg.exe" OR process_file_name="attrib.exe" - OR process_file_name="at.exe" OR process_file_name="appidpolicyconverter.exe" OR - process_file_name="appidcertstorecheck.exe" OR process_file_name="alg.exe" OR process_file_name="aitstatic.exe" - OR process_file_name="aitagent.exe" OR process_file_name="acu.exe" OR process_file_name="wpcmon.exe" - OR process_file_name="workfolders.exe" OR process_file_name="windowsupdateelevatedinstaller.exe" - OR process_file_name="windowsanytimeupgradeui.exe" OR process_file_name="windowsanytimeupgraderesults.exe" - OR process_file_name="windowsanytimeupgrade.exe" OR process_file_name="windowsactiondialog.exe" - OR process_file_name="windows.media.backgroundplayback.exe" OR process_file_name="winsat.exe" - OR process_file_name="werfaultsecure.exe" OR process_file_name="werfault.exe" OR - process_file_name="webcache.exe" OR process_file_name="wallpaperhost.exe" OR process_file_name="wwahost.exe" - OR process_file_name="wudfhost.exe" OR process_file_name="wsreset.exe" OR process_file_name="wsmanhttpconfig.exe" - OR process_file_name="wscollect.exe" OR process_file_name="wpdshextautoplay.exe" - OR process_file_name="wmpdmc.exe" OR process_file_name="wfs.exe" OR process_file_name="vaultsysui.exe" - OR process_file_name="vaultcmd.exe" OR process_file_name="vssvc.exe" OR process_file_name="utilman.exe" - OR process_file_name="usoclient.exe" OR process_file_name="useraccountcontrolsettings.exe" - OR process_file_name="useraccountbroker.exe" OR process_file_name="upgraderesultsui.exe" - OR process_file_name="ui0detect.exe" OR process_file_name="tswpfwrp.exe" OR process_file_name="tpminit.exe" - OR process_file_name="tokenbrokercookies.exe" OR process_file_name="thumbnailextractionhost.exe" - OR process_file_name="taskmgr.exe" OR process_file_name="tapiunattend.exe" OR process_file_name="tswbprxy.exe" - OR process_file_name="tstheme.exe" OR process_file_name="tracert.exe" OR process_file_name="tcpsvcs.exe" - OR process_file_name="systemsettingsremovedevice.exe" OR process_file_name="systemsettingsbroker.exe" - OR process_file_name="systemsettingsadminflows.exe" OR process_file_name="systempropertiesremote.exe" - OR process_file_name="systempropertiesprotection.exe" OR process_file_name="systempropertiesperformance.exe" - OR process_file_name="systempropertieshardware.exe" OR process_file_name="systempropertiesdataexecutionprevention.exe" - OR process_file_name="systempropertiescomputername.exe" OR process_file_name="systempropertiesadvanced.exe" - OR process_file_name="sysreseterr.exe" OR process_file_name="synchost.exe" OR process_file_name="stikynot.exe" - OR process_file_name="srtasks.exe" OR process_file_name="sppextcomobj.exe" OR process_file_name="spaceagent.exe" - OR process_file_name="soundrecorder.exe" OR process_file_name="snippingtool.exe" - OR process_file_name="sndvol.exe" OR process_file_name="smartscreensettings.exe" - OR process_file_name="slidetoshutdown.exe" OR process_file_name="settingsynchost.exe" - OR process_file_name="setieinstalleddate.exe" OR process_file_name="sensordataservice.exe" - OR process_file_name="secedit.exe" OR process_file_name="searchprotocolhost.exe" - OR process_file_name="searchindexer.exe" OR process_file_name="searchfilterhost.exe" - OR process_file_name="sihclient.exe" OR process_file_name="runtimebroker.exe" OR - process_file_name="runlegacycplelevated.exe" OR process_file_name="rpcping.exe" - OR process_file_name="rmclient.exe" OR process_file_name="remoteposworker.exe" OR - process_file_name="relpost.exe" OR process_file_name="registeriepkeys.exe" OR process_file_name="register-cimprovider.exe" - OR process_file_name="recoverydrive.exe" OR process_file_name="reagentc.exe" OR - process_file_name="rdpsauachelper.exe" OR process_file_name="rdpsaproxy.exe" OR - process_file_name="rdpsa.exe" OR process_file_name="route.exe" OR process_file_name="rmactivate_ssp_isv.exe" - OR process_file_name="rmactivate_ssp.exe" OR process_file_name="rmactivate_isv.exe" - OR process_file_name="rmactivate.exe" OR process_file_name="rdspnf.exe" OR process_file_name="proximityuxhost.exe" - OR process_file_name="printisolationhost.exe" OR process_file_name="printdialoghost3d.exe" - OR process_file_name="printdialoghost.exe" OR process_file_name="printbrmui.exe" - OR process_file_name="presentationsettings.exe" OR process_file_name="presentationhost.exe" - OR process_file_name="pnputil.exe" OR process_file_name="pnpunattend.exe" OR process_file_name="pkgmgr.exe" - OR process_file_name="pickerhost.exe" OR process_file_name="passwordonwakesettingflyout.exe" - OR process_file_name="ping.exe" OR process_file_name="pathping.exe" OR process_file_name="optionalfeatures.exe" - OR process_file_name="openwith.exe" OR process_file_name="networkuxbroker.exe" OR - process_file_name="netplwiz.exe" OR process_file_name="netproj.exe" OR process_file_name="netevtfwdr.exe" - OR process_file_name="netcfgnotifyobjecthost.exe" OR process_file_name="narrator.exe" - OR process_file_name="netstat.exe" OR process_file_name="napstat.exe" OR process_file_name="musnotificationux.exe" - OR process_file_name="musnotification.exe" OR process_file_name="multidigimon.exe" - OR process_file_name="muiunattend.exe" OR process_file_name="msspellcheckinghost.exe" - OR process_file_name="mpsigstub.exe" OR process_file_name="migautoplay.exe" OR process_file_name="mdsched.exe" - OR process_file_name="mdres.exe" OR process_file_name="mbaeparsertask.exe" OR process_file_name="magnify.exe" - OR process_file_name="mschedexe.exe" OR process_file_name="mrt.exe" OR process_file_name="mrinfo.exe" - OR process_file_name="mdmappinstaller.exe" OR process_file_name="mdmagent.exe" OR - process_file_name="mdeserver.exe" OR process_file_name="lsaiso.exe" OR process_file_name="logonui.exe" - OR process_file_name="lockscreencontentserver.exe" OR process_file_name="lockapphost.exe" - OR process_file_name="locator.exe" OR process_file_name="locationnotifications.exe" - OR process_file_name="locationnotificationwindows.exe" OR process_file_name="licensingui.exe" - OR process_file_name="licensemanagershellext.exe" OR process_file_name="legacynetuxhost.exe" - OR process_file_name="launchwinapp.exe" OR process_file_name="launchtm.exe" OR process_file_name="languagecomponentsinstallercomhandler.exe" - OR process_file_name="installagent.exe" OR process_file_name="infdefaultinstall.exe" - OR process_file_name="icsentitlementhost.exe" OR process_file_name="hostname.exe" - OR process_file_name="gettingstarted.exe" OR process_file_name="genvalobj.exe" OR - process_file_name="gamepanel.exe" OR process_file_name="fondue.exe" OR process_file_name="filehistory.exe" - OR process_file_name="fxsunatd.exe" OR process_file_name="fxssvc.exe" OR process_file_name="fxscover.exe" - OR process_file_name="ehstorauthn.exe" OR process_file_name="easeofaccessdialog.exe" - OR process_file_name="easpoliciesbrokerhost.exe" OR process_file_name="eap3host.exe" - OR process_file_name="eosnotify.exe" OR process_file_name="edpcleanup.exe" OR process_file_name="dxpserver.exe" - OR process_file_name="dsmusertask.exe" OR process_file_name="dpiscaling.exe" OR - process_file_name="dmomacpmo.exe" OR process_file_name="dmnotificationbroker.exe" - OR process_file_name="displayswitch.exe" OR process_file_name="dism.exe" OR process_file_name="disksnapshot.exe" - OR process_file_name="deviceproperties.exe" OR process_file_name="devicepairingwizard.exe" - OR process_file_name="deviceenroller.exe" OR process_file_name="deviceeject.exe" - OR process_file_name="devicedisplayobjectprovider.exe" OR process_file_name="defrag.exe" - OR process_file_name="dataexchangehost.exe" OR process_file_name="dwwin.exe" OR - process_file_name="dfdwiz.exe" OR process_file_name="credentialuibroker.exe" OR - process_file_name="computerdefaults.exe" OR process_file_name="compattelrunner.exe" - OR process_file_name="compmgmtlauncher.exe" OR process_file_name="cloudstoragewizard.exe" - OR process_file_name="cloudnotifications.exe" OR process_file_name="cloudexperiencehostbroker.exe" - OR process_file_name="clipup.exe" OR process_file_name="checknetisolation.exe" OR - process_file_name="certenrollctrl.exe" OR process_file_name="castsrv.exe" OR process_file_name="camerasettingsuihost.exe" - OR process_file_name="bytecodegenerator.exe" OR process_file_name="bitlockerwizardelev.exe" - OR process_file_name="bitlockerwizard.exe" OR process_file_name="bitlockerdeviceencryption.exe" - OR process_file_name="bdeunlockwizard.exe" OR process_file_name="bdeuisrv.exe" OR - process_file_name="bdehdcfg.exe" OR process_file_name="backgroundtransferhost.exe" - OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR - process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe" - OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe") - AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match(process_file_path, - /(?i)\\windows\\system32/)=true) --finding_report--' + | eval device_hostname = device.hostname | where (process_file_name IN ("xwizard.exe", + "xpsrchvw.exe", "xcopy.exe", "wusa.exe", "wuauclt.exe", "wuapp.exe", "wuapihost.exe", + "wsqmcons.exe", "wsmprovhost.exe", "wscript.exe", "write.exe", "wpr.exe", "wpnpinst.exe", + "wowreg32.exe", "wlrmdr.exe", "wlanext.exe", "wksprt.exe", "wkspbroker.exe", "wisptis.exe", + "winver.exe", "winrshost.exe", "winrs.exe", "winresume.exe", "winlogon.exe", "winload.exe", + "wininit.exe", "wimserv.exe", "wifitask.exe", "wiawow64.exe", "wiaacmgr.exe", "whoami.exe", + "where.exe", "wextract.exe", "wevtutil.exe", "wermgr.exe", "wecutil.exe", "wbengine.exe", + "wbadmin.exe", "waitfor.exe", "w32tm.exe", "vssadmin.exe", "vmicsvc.exe", "verifiergui.exe", + "verifier.exe", "verclsid.exe", "vdsldr.exe", "vds.exe", "userinit.exe", "upnpcont.exe", + "unregmp2.exe", "unlodctr.exe", "ucsvc.exe", "tzutil.exe", "tzsync.exe", "typeperf.exe", + "tskill.exe", "tsdiscon.exe", "tscon.exe", "tracerpt.exe", "tpmvscmgrsvr.exe", "tpmvscmgr.exe", + "timeout.exe", "tcmsetup.exe", "taskmgr.exe", "tasklist.exe", "taskkill.exe", "taskhostw.exe", + "taskhost.exe", "taskeng.exe", "takeown.exe", "tabcal.exe", "systray.exe", "systemreset.exe", + "systeminfo.exe", "syskey.exe", "sxstrace.exe", "svchost.exe", "subst.exe", "srdelayed.exe", + "spreview.exe", "sppsvc.exe", "spoolsv.exe", "spinstall.exe", "sort.exe", "snmptrap.exe", + "smss.exe", "slui.exe", "sihost.exe", "sigverif.exe", "shutdown.exe", "shrpubw.exe", + "shadow.exe", "setx.exe", "setupugc.exe", "setupcl.exe", "setspn.exe", "sethc.exe", + "sessionmsg.exe", "services.exe", "secinit.exe", "sdiagnhost.exe", "sdclt.exe", + "sdchange.exe", "sdbinst.exe", "schtasks.exe", "sc.exe", "sbunattend.exe", "rwinsta.exe", + "runonce.exe", "rundll32.exe", "runas.exe", "rstrui.exe", "rrinstaller.exe", "rmttpmvscmgrsvr.exe", + "resmon.exe", "reset.exe", "replace.exe", "repair-bde.exe", "relog.exe", "rekeywiz.exe", + "regsvr32.exe", "regini.exe", "regedt32.exe", "reg.exe", "recover.exe", "recdisc.exe", + "rdrleakdiag.exe", "rdpinput.exe", "rdpclip.exe", "rasphone.exe", "raserver.exe", + "rasdial.exe", "rasautou.exe", "qwinsta.exe", "quser.exe", "query.exe", "qprocess.exe", + "qappsrv.exe", "pwlauncher.exe", "psr.exe", "provtool.exe", "proquota.exe", "printui.exe", + "printfilterpipelinesvc.exe", "print.exe", "prevhost.exe", "powercfg.exe", "poqexec.exe", + "plasrv.exe", "phoneactivate.exe", "perfmon.exe", "pcwrun.exe", "pcawrk.exe", "pcaui.exe", + "pcalua.exe", "p2phost.exe", "osk.exe", "openfiles.exe", "omadmprc.exe", "omadmclient.exe", + "odbcconf.exe", "odbcad32.exe", "ocsetup.exe", "ntprint.exe", "ntoskrnl.exe", "nslookup.exe", + "notepad.exe", "nltest.exe", "newdev.exe", "netsh.exe", "netiougc.exe", "netcfg.exe", + "netbtugc.exe", "net1.exe", "net.exe", "ndadmin.exe", "nbtstat.exe", "mtstocom.exe", + "mstsc.exe", "msra.exe", "mspaint.exe", "msinfo32.exe", "msiexec.exe", "mshta.exe", + "msg.exe", "msfeedssync.exe", "msdtc.exe", "msdt.exe", "msconfig.exe", "mpnotify.exe", + "mountvol.exe", "mobsync.exe", "mmc.exe", "mfpmp.exe", "mctadmin.exe", "mcbuilder.exe", + "mblctr.exe", "manage-bde.exe", "makecab.exe", "lsm.exe", "lsass.exe", "lpremove.exe", + "lpksetup.exe", "lpkinstall.exe", "logoff.exe", "logman.exe", "logagent.exe", "lodctr.exe", + "licensingdiag.exe", "label.exe", "ktmutil.exe", "ksetup.exe", "klist.exe", "isoburn.exe", + "iscsicpl.exe", "iscsicli.exe", "irftp.exe", "ipconfig.exe", "immersivetpmvscmgrsvr.exe", + "iexpress.exe", "ieetwcollector.exe", "ieunatt.exe", "ie4uinit.exe", "icsunattend.exe", + "icardagt.exe", "icacls.exe", "hwrreg.exe", "hwrcomp.exe", "help.exe", "hdwwiz.exe", + "grpconv.exe", "gpupdate.exe", "gpscript.exe", "gpresult.exe", "getmac.exe", "fveprompt.exe", + "fvenotify.exe", "ftp.exe", "fsutil.exe", "fsquirt.exe", "fsavailux.exe", "forfiles.exe", + "fontview.exe", "fontdrvhost.exe", "fodhelper.exe", "fltmc.exe", "fixmapi.exe", + "finger.exe", "findstr.exe", "find.exe", "fhmanagew.exe", "fc.exe", "extrac32.exe", + "expand.exe", "eventvwr.exe", "eventcreate.exe", "eudcedit.exe", "esentutl.exe", + "embeddedapplauncher.exe", "efsui.exe", "easinvoker.exe", "dxdiag.exe", "dwm.exe", + "dvdupgrd.exe", "dvdplay.exe", "dstokenclean.exe", "dsregcmd.exe", "drvinst.exe", + "drvcfg.exe", "driverquery.exe", "dpnsvr.exe", "dpapimig.exe", "doskey.exe", "dnscacheugc.exe", + "dmclient.exe", "dmcfghost.exe", "dmcertinst.exe", "dllhst3g.exe", "dllhost.exe", + "djoin.exe", "dispdiag.exe", "diskraid.exe", "diskperf.exe", "diskpart.exe", "dinotify.exe", + "diantz.exe", "dialer.exe", "dfrgui.exe", "ddodiag.exe", "dcomcnfg.exe", "dccw.exe", + "dashost.exe", "cttunesvr.exe", "cttune.exe", "ctfmon.exe", "csrss.exe", "cscript.exe", + "credwiz.exe", "convert.exe", "control.exe", "consent.exe", "conhost.exe", "compact.exe", + "comp.exe", "colorcpl.exe", "cofire.exe", "cmstp.exe", "cmmon32.exe", "cmdl32.exe", + "cmdkey.exe", "cmd.exe", "clip.exe", "cliconfg.exe", "cleanmgr.exe", "cipher.exe", + "choice.exe", "chkntfs.exe", "chkdsk.exe", "chgusr.exe", "chgport.exe", "chglogon.exe", + "charmap.exe", "changepk.exe", "change.exe", "certutil.exe", "certreq.exe", "cdpreference.exe", + "calc.exe", "cacls.exe", "bthudtask.exe", "browser_broker.exe", "bridgeunattend.exe", + "bootsect.exe", "bootim.exe", "bootcfg.exe", "bitsadmin.exe", "bdeunlock.exe", "bdechangepin.exe", + "bcdedit.exe", "bcdboot.exe", "bcastdvr.exe", "backgroundtaskhost.exe", "baaupdate.exe", + "autofmt.exe", "autoconv.exe", "autochk.exe", "auditpol.exe", "audiodg.exe", "attrib.exe", + "at.exe", "appidpolicyconverter.exe", "appidcertstorecheck.exe", "alg.exe", "aitstatic.exe", + "aitagent.exe", "acu.exe", "wpcmon.exe", "workfolders.exe", "windowsupdateelevatedinstaller.exe", + "windowsanytimeupgradeui.exe", "windowsanytimeupgraderesults.exe", "windowsanytimeupgrade.exe", + "windowsactiondialog.exe", "windows.media.backgroundplayback.exe", "winsat.exe", + "werfaultsecure.exe", "werfault.exe", "webcache.exe", "wallpaperhost.exe", "wwahost.exe", + "wudfhost.exe", "wsreset.exe", "wsmanhttpconfig.exe", "wscollect.exe", "wpdshextautoplay.exe", + "wmpdmc.exe", "wfs.exe", "vaultsysui.exe", "vaultcmd.exe", "vssvc.exe", "utilman.exe", + "usoclient.exe", "useraccountcontrolsettings.exe", "useraccountbroker.exe", "upgraderesultsui.exe", + "ui0detect.exe", "tswpfwrp.exe", "tpminit.exe", "tokenbrokercookies.exe", "thumbnailextractionhost.exe", + "taskmgr.exe", "tapiunattend.exe", "tswbprxy.exe", "tstheme.exe", "tracert.exe", + "tcpsvcs.exe", "systemsettingsremovedevice.exe", "systemsettingsbroker.exe", "systemsettingsadminflows.exe", + "systempropertiesremote.exe", "systempropertiesprotection.exe", "systempropertiesperformance.exe", + "systempropertieshardware.exe", "systempropertiesdataexecutionprevention.exe", "systempropertiescomputername.exe", + "systempropertiesadvanced.exe", "sysreseterr.exe", "synchost.exe", "stikynot.exe", + "srtasks.exe", "sppextcomobj.exe", "spaceagent.exe", "soundrecorder.exe", "snippingtool.exe", + "sndvol.exe", "smartscreensettings.exe", "slidetoshutdown.exe", "settingsynchost.exe", + "setieinstalleddate.exe", "sensordataservice.exe", "secedit.exe", "searchprotocolhost.exe", + "searchindexer.exe", "searchfilterhost.exe", "sihclient.exe", "runtimebroker.exe", + "runlegacycplelevated.exe", "rpcping.exe", "rmclient.exe", "remoteposworker.exe", + "relpost.exe", "registeriepkeys.exe", "register-cimprovider.exe", "recoverydrive.exe", + "reagentc.exe", "rdpsauachelper.exe", "rdpsaproxy.exe", "rdpsa.exe", "route.exe", + "rmactivate_ssp_isv.exe", "rmactivate_ssp.exe", "rmactivate_isv.exe", "rmactivate.exe", + "rdspnf.exe", "proximityuxhost.exe", "printisolationhost.exe", "printdialoghost3d.exe", + "printdialoghost.exe", "printbrmui.exe", "presentationsettings.exe", "presentationhost.exe", + "pnputil.exe", "pnpunattend.exe", "pkgmgr.exe", "pickerhost.exe", "passwordonwakesettingflyout.exe", + "ping.exe", "pathping.exe", "optionalfeatures.exe", "openwith.exe", "networkuxbroker.exe", + "netplwiz.exe", "netproj.exe", "netevtfwdr.exe", "netcfgnotifyobjecthost.exe", "narrator.exe", + "netstat.exe", "napstat.exe", "musnotificationux.exe", "musnotification.exe", "multidigimon.exe", + "muiunattend.exe", "msspellcheckinghost.exe", "mpsigstub.exe", "migautoplay.exe", + "mdsched.exe", "mdres.exe", "mbaeparsertask.exe", "magnify.exe", "mschedexe.exe", + "mrt.exe", "mrinfo.exe", "mdmappinstaller.exe", "mdmagent.exe", "mdeserver.exe", + "lsaiso.exe", "logonui.exe", "lockscreencontentserver.exe", "lockapphost.exe", "locator.exe", + "locationnotifications.exe", "locationnotificationwindows.exe", "licensingui.exe", + "licensemanagershellext.exe", "legacynetuxhost.exe", "launchwinapp.exe", "launchtm.exe", + "languagecomponentsinstallercomhandler.exe", "installagent.exe", "infdefaultinstall.exe", + "icsentitlementhost.exe", "hostname.exe", "gettingstarted.exe", "genvalobj.exe", + "gamepanel.exe", "fondue.exe", "filehistory.exe", "fxsunatd.exe", "fxssvc.exe", + "fxscover.exe", "ehstorauthn.exe", "easeofaccessdialog.exe", "easpoliciesbrokerhost.exe", + "eap3host.exe", "eosnotify.exe", "edpcleanup.exe", "dxpserver.exe", "dsmusertask.exe", + "dpiscaling.exe", "dmomacpmo.exe", "dmnotificationbroker.exe", "displayswitch.exe", + "dism.exe", "disksnapshot.exe", "deviceproperties.exe", "devicepairingwizard.exe", + "deviceenroller.exe", "deviceeject.exe", "devicedisplayobjectprovider.exe", "defrag.exe", + "dataexchangehost.exe", "dwwin.exe", "dfdwiz.exe", "credentialuibroker.exe", "computerdefaults.exe", + "compattelrunner.exe", "compmgmtlauncher.exe", "cloudstoragewizard.exe", "cloudnotifications.exe", + "cloudexperiencehostbroker.exe", "clipup.exe", "checknetisolation.exe", "certenrollctrl.exe", + "castsrv.exe", "camerasettingsuihost.exe", "bytecodegenerator.exe", "bitlockerwizardelev.exe", + "bitlockerwizard.exe", "bitlockerdeviceencryption.exe", "bdeunlockwizard.exe", "bdeuisrv.exe", + "bdehdcfg.exe", "backgroundtransferhost.exe", "axinstui.exe", "autoworkplace.exe", + "authhost.exe", "atbroker.exe", "applicationframehost.exe", "adaptertroubleshooter.exe", + "arp.exe")) AND (NOT match(process_file_path, /(?i)\\windows\\syswow64/)=true) AND + (NOT match(process_file_path, /(?i)\\windows\\system32/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] From 3d55d6061b5ba1c96d9ae74ec9d2be8c2f7b5795 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 14 Aug 2023 12:46:35 +0200 Subject: [PATCH 07/89] Improved windows powershell hidden detection --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index f580d559a3..185c485bc6 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -26,7 +26,7 @@ search: - pwsh.exe - pwsh.exe selection2: - process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-] + process.cmd_line|re: '[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+' condition: selection1 and selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 80aa84648f..9e113066db 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -20,7 +20,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true + /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 8b565f275c..bfedc21e2c 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -26,7 +26,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true --finding_report--' + /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. From fcb174d163798677b82bb09177c6e376c277ee84 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 18 Aug 2023 13:34:14 +0200 Subject: [PATCH 08/89] bug fix --- .../builder/backend_splunk_ba.py | 2 +- ...ted_credential_dump_from_registry_via_reg_exe.yml | 12 ++++++------ ...rshell_connect_to_internet_with_hidden_window.yml | 2 +- ...rshell_connect_to_internet_with_hidden_window.yml | 2 +- .../endpoint/ssa___windows_remote_create_service.yml | 2 +- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py index 1333e0cc4d..b6d745b595 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/backend_splunk_ba.py @@ -34,7 +34,7 @@ class SplunkBABackend(TextQueryBackend): add_escaped : ClassVar[str] = "\\" re_expression : ClassVar[str] = "match({field}, /(?i){regex}/)=true" - re_escape_char : ClassVar[str] = "\\" + re_escape_char : ClassVar[str] = "" re_escape : ClassVar[Tuple[str]] = ('"',) cidr_expression : ClassVar[str] = "{value}" diff --git a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index d5f7875df1..63be50fb9f 100644 --- a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -17,12 +17,12 @@ search: - cmd.exe selection2: process.cmd_line|re: - - HKEY_LOCAL_MACHINE\System - - HKEY_LOCAL_MACHINE\SAM - - HKEY_LOCAL_MACHINE\Security - - HKLM\System - - HKLM\SAM - - HKLM\Security + - HKEY_LOCAL_MACHINE\\System + - HKEY_LOCAL_MACHINE\\SAM + - HKEY_LOCAL_MACHINE\\Security + - HKLM\\System + - HKLM\\SAM + - HKLM\\Security selection3: process.cmd_line|re: save condition: selection1 and (selection2) and selection3 diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 9e113066db..86140ae90b 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -20,7 +20,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true + /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index bfedc21e2c..d69a5fb387 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -26,7 +26,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval device_hostname = device.hostname | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match(process_cmd_line, - /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' + /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h(i*d*d*e*n*)\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml index 74de00e694..82a3000a0b 100644 --- a/ssa_detections/endpoint/ssa___windows_remote_create_service.yml +++ b/ssa_detections/endpoint/ssa___windows_remote_create_service.yml @@ -19,7 +19,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where (match(process_cmd_line, /(?i)create/)=true - OR match(process_cmd_line, /(?i)\\\\/)=true) AND process_file_name="sc.exe" --finding_report--' + OR match(process_cmd_line, /(?i)\\/)=true) AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From 0c2ee7d288ebd7e586d39c5e49ac4f0ab4f41c84 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 13 Sep 2023 11:25:18 +0200 Subject: [PATCH 09/89] njrat --- ...ound_traffic_by_firewall_rule_registry.yml | 1 + .../allow_network_discovery_in_firewall.yml | 1 + ...cmd_carry_out_string_command_parameter.yml | 1 + .../endpoint/excessive_usage_of_taskkill.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 1 + .../firewall_allowed_program_enable.yml | 1 + ...e_process_accessing_chrome_default_dir.yml | 1 + ...fox_process_access_firefox_profile_dir.yml | 2 ++ ...script_contains_base64_encoded_content.yml | 1 + .../registry_keys_used_for_persistence.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + ..._autostart_execution_in_startup_folder.yml | 1 + ...ssword_stores_chrome_localstate_access.yml | 1 + ...ssword_stores_chrome_login_data_access.yml | 1 + ...ws_raw_access_to_disk_volume_partition.yml | 1 + ...raw_access_to_master_boot_record_drive.yml | 1 + ...ws_replication_through_removable_media.yml | 24 ++++++++--------- .../windows_system_logoff_commandline.yml | 3 ++- .../windows_system_reboot_commandline.yml | 3 ++- .../windows_system_shutdown_commandline.yml | 3 ++- .../windows_unsigned_dll_side_loading.yml | 3 ++- ...pt_or_cscript_suspicious_child_process.yml | 1 + stories/njrat.yml | 26 +++++++++++++++++++ 23 files changed, 64 insertions(+), 16 deletions(-) create mode 100644 stories/njrat.yml diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 72fac955c1..b41aa519dd 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -29,6 +29,7 @@ tags: - Prohibited Traffic Allowed or Protocol Mismatch - Windows Registry Abuse - Azorult + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 13fc33529a..bbf50765ba 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -33,6 +33,7 @@ tags: - Ransomware - Revil Ransomware - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 036a01fc20..fe126c5ee7 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -46,6 +46,7 @@ tags: - Azorult - Data Destruction - Warzone RAT + - NjRAT asset_type: Endpoint automated_detection_testing: passed confidence: 50 diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 73937a219d..4b0d1e539c 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -31,6 +31,7 @@ tags: - CISA AA22-264A - AgentTesla - CISA AA22-277A + - NjRAT asset_type: Endpoint confidence: 70 impact: 40 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index cf58957157..5f81c219c1 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -62,6 +62,7 @@ tags: - Amadey - BlackByte Ransomware - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 50 impact: 40 diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 41cb565451..302e17d20f 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -34,6 +34,7 @@ tags: - Windows Defense Evasion Tactics - Azorult - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 0823d14c8f..f4632537f6 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -34,6 +34,7 @@ tags: - RedLine Stealer - FIN7 - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 25dded39df..8eefc06bef 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -34,6 +34,8 @@ tags: - AgentTesla - RedLine Stealer - FIN7 + - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 50 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index f1bfcbf548..48d40271d2 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -44,6 +44,7 @@ tags: - AsyncRAT - Data Destruction - IcedID + - NjRAT confidence: 80 impact: 70 message: A suspicious powershell script contains base64 command in $ScriptBlockText$ diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 8e119c4e3c..2b457ad733 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -69,6 +69,7 @@ tags: - Sneaky Active Directory Persistence Tricks - BlackByte Ransomware - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 95 impact: 80 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 8505c38fb5..81e592bf47 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -46,6 +46,7 @@ tags: - Azorult - Amadey - Scheduled Tasks + - NjRAT asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 515e19a157..c0e6e1c831 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Chaos Ransomware + - NjRAT asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 42d159f29f..d1f7a5dcea 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -30,6 +30,7 @@ tags: - RedLine Stealer - Amadey - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index df3f1faa77..502c92cc19 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -30,6 +30,7 @@ tags: - RedLine Stealer - Amadey - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 6e41f44515..af21195353 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -33,6 +33,7 @@ tags: - Hermetic Wiper - Caddy Wiper - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 100 impact: 90 diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index e9ddffbcac..1cf01ee891 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -36,6 +36,7 @@ tags: - Hermetic Wiper - Caddy Wiper - BlackByte Ransomware + - NjRAT asset_type: Endpoint confidence: 100 impact: 90 diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 54bc7b0cf6..7cb4039141 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,7 +1,7 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 version: 1 -date: '2023-01-17' +date: '2023-09-07' author: Teoderick Contreras, Splunk status: production type: TTP @@ -18,17 +18,16 @@ description: This analytic is developed to detect suspicious executable or scrip and the reason why that executable or scripts are dropped in the root drive. data_source: - Sysmon Event ID 11 -search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = *.exe - OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys OR Filesystem.file_name - = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name - = *.js OR Filesystem.file_name= *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name - = *.pif) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.user | `drop_dm_object_name(Filesystem)` | eval - dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count - = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | - where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= - "C:" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") + | eval dropped_file_path_split_count = mvcount(dropped_file_path) + | eval root_drive = mvindex(dropped_file_path,0) + | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= "C:" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_replication_through_removable_media_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from @@ -41,6 +40,7 @@ references: tags: analytic_story: - Chaos Ransomware + - NjRAT asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index f611623f10..1308add224 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -16,7 +16,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*" + Processes.process="*shutdown*" Processes.process IN ("* /l*", "* -l*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -34,6 +34,7 @@ references: tags: analytic_story: - DarkCrystal RAT + - NjRAT asset_type: Endpoint confidence: 80 impact: 70 diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index f12df962ab..5e2eaf24c3 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -17,7 +17,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*" + Processes.process="*shutdown*" Processes.process IN ("* /r*", "* -r*") Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -35,6 +35,7 @@ references: tags: analytic_story: - DarkCrystal RAT + - NjRAT asset_type: Endpoint confidence: 50 impact: 60 diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 32d0824149..4b704fe2da 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -19,7 +19,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) - Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*", "* /r*", "* -r*") AND Processes.process="* /t*" + Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*") AND Processes.process IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -38,6 +38,7 @@ tags: analytic_story: - DarkCrystal RAT - Sandworm Tools + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 25159dabc3..1c20577301 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -7,7 +7,7 @@ status: production type: Anomaly data_source: - Sysmon Event ID 7 -description: This analysis focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders. +description: This analytic focuses on detecting potentially malicious unsigned DLLs created in either the c:\windows\system32 or c:\windows\syswow64 folders. This particular technique was observed in the context of the Warzone (Ave Maria) RAT, where it employed a method known as DLL hijacking (dll-side-loading) by dropping the "dismcore.dll" to achieve privilege escalation. DLL hijacking is a stealthy attack technique used by cybercriminals to exploit the way Windows searches and loads DLLs. By placing a malicious DLL with the @@ -30,6 +30,7 @@ references: tags: analytic_story: - Warzone RAT + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index dab7c518b8..d86be7885b 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -36,6 +36,7 @@ tags: - Unusual Processes - Data Destruction - WhisperGate + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/stories/njrat.yml b/stories/njrat.yml new file mode 100644 index 0000000000..8076793ff8 --- /dev/null +++ b/stories/njrat.yml @@ -0,0 +1,26 @@ +name: NjRat +id: f6d52454-6cf3-4759-9627-5868a3e2b2b1 +version: 2 +date: '2023-09-07' +author: Teoderick Contreras, Splunk +description: NjRat is a notorious remote access trojan (RAT) predominantly wielded by malicious operators to infiltrate and wield remote control over compromised systems. + This analytical story harnesses targeted search methodologies to uncover and investigate activities that could be indicative of NjRAT's presence. + These activities include tracking file write operations for dropped files, scrutinizing registry modifications aimed at establishing persistence mechanisms, + monitoring suspicious processes, self-deletion behaviors, browser credential parsing, firewall configuration alterations, spread itself via removable drive and an array of other potentially + malicious actions. +narrative: NjRat is also known as Bladabindi malware that was first discovered in the wild in 2012. Since then this malware remain active and uses different campaign to spred its malware. + While its primary infection vectors are phishing attacks and drive-by downloads, it also has "worm" capability to spread itself via infected removable drives. This RAT has various of capabilities including + keylogging, webcam access, browser credential parsing, file upload and downloads, file and process list, service list, shell command execution, registry modification, screen capture, view the desktop of the infected computer and many more. + NjRat does not target any industry in particular, but attacking a wide variety of individuals and organizations to gather sensitive information. +references: + - https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/what-is-njrat-malware/#:~:text=NJRat%20%E2%80%94%20also%20known%20as%20Bladabindi,malware%20variant%20in%20March%202023. + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: NjRAT + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 59e0e8601e9dc9c8d5d4279a9effa2ea7fdfbc49 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 13 Sep 2023 13:17:58 -0700 Subject: [PATCH 10/89] Initial commit of draft searches before adding datasets --- ...te_path_traversal_using_runshellscript.yml | 46 +++++++++++++++++ ...k_cmd_injection_using_external_lookups.yml | 48 ++++++++++++++++++ ...plunk_dos_using_malformed_saml_request.yml | 47 +++++++++++++++++ ...ected_xss_on_app_search_table_endpoint.yml | 50 +++++++++++++++++++ 4 files changed, 191 insertions(+) create mode 100644 detections/application/splunk_absolute_path_traversal_using_runshellscript.yml create mode 100644 detections/application/splunk_cmd_injection_using_external_lookups.yml create mode 100644 detections/application/splunk_dos_using_malformed_saml_request.yml create mode 100644 detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml new file mode 100644 index 0000000000..0d6bef11dd --- /dev/null +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -0,0 +1,46 @@ +name: Splunk Absolute Path Traversal Using runshellscript +id: 356bd3fe-f59b-4f64-baa1-51495411b7ad +version: 1 +date: '2023-09-05' +author: Rod Soto +status: production +type: Hunting +data_source: +- python.log +description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. +search: '|`splunk_python` *runshellscript* | `splunk_absolute_path_traversal_using_runshellscript_filter`' +how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. +known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. +references: +- https://advisory.splunk.com/advisories/SVD-2023-0806 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: endpoint + confidence: 70 + impact: 50 + message: Possible attack abusing runshellscript + mitre_attack_id: + - T1083 + cve: + - CVE-2023-40597 + observable: + - name: other + type: Unknown + role: + - Unknown + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 35 + required_fields: + - search + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: UPDATE url to dataset + source: python.log + sourcetype: splunk_python + custom_index: _internal diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml new file mode 100644 index 0000000000..503afd6058 --- /dev/null +++ b/detections/application/splunk_cmd_injection_using_external_lookups.yml @@ -0,0 +1,48 @@ +name: Splunk cmd injection using external lookups +id: 901ae2e2-b47b-4adc-b296-a151a8fccdca +version: 1 +date: '2023-09-05' +author: Rod Soto +status: production +type: Hunting +data_source: +- audittrial +description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. +search: '|`audit_searches` search = \"| *runshellscript*\ \ \\\"\\\"\" \n| stats earliest(_time) as event_time count by search user splunk_server\n\ | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups`' +how_to_implement: Must have access to internal audit index. +known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. +references: +- https://advisory.splunk.com/advisories +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: endpoint + confidence: 50 + impact: 30 + message: Possible exploitation attempt against $host$ + mitre_attack_id: + - T1202 + cve: + - CVE-2023-40598 + observable: + - name: host + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 15 + required_fields: + - search + - user + - splunk_server + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: UPDATE url to dataset + source: audittrail + sourcetype: audittrail + custom_index: _audit diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml new file mode 100644 index 0000000000..d0c685a13d --- /dev/null +++ b/detections/application/splunk_dos_using_malformed_saml_request.yml @@ -0,0 +1,47 @@ +name: Splunk DoS Using Malformed SAML Request +id: 8e8a86d5-f323-4567-95be-8e817e2baee6 +version: 1 +date: '2023-09-05' +author: Rod Soto +status: production +type: Hunting +data_source: +- splunkd.log +description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang. +search: '`splunkd` message=*error* expr=*xpointer* | stats count by component expr host event_message | `splunk_dos_using_malformed_saml_request_filter`' +how_to_implement: Must have access to internal indexes. +known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. +references: +- https://advisory.splunk.com/advisories/SVD-2023-0802 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: endpoint + confidence: 30 + impact: 50 + message: Possible DoS attack against $host$ + mitre_attack_id: + - T1498 + observable: + - name: host + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 15 + required_fields: + - component + - expr + - host + - event_message + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: UPDATE url to dataset + source: splunkd.log + sourcetype: splunkd + custom_index: _internal \ No newline at end of file diff --git a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml new file mode 100644 index 0000000000..1b949c854e --- /dev/null +++ b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -0,0 +1,50 @@ +name: Splunk Reflected XSS on app search table endpoint +id: 182f9080-4137-4629-94ac-cb1083ac981a +version: 1 +date: '2023-09-05' +author: Rod Soto +status: production +type: Hunting +data_source: +- web_access.log +description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the app search table web endpoint, which presents as the Create Table View page in Splunk Web. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. A JavaScript file within this web endpoint does not properly validate input which lets an attacker insert a payload into a function. +search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats earliest(_time) as event_time count by clientip status user view root uri_path | convert ctime(*time) | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' +how_to_implement: Need access to the internal indexes. +known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string. +references: +- https://advisory.splunk.com/advisories/SVD-2023-0801 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: endpoint + confidence: 40 + impact: 30 + message: Possible XSS attack against from $user$ + mitre_attack_id: + - T1189 + observable: + - name: user + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 12 + required_fields: + - dataset_commands + - clientip + - status + - user + - view + - root + - uri_path + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: UPDATE url to dataset + source: web_access.log + sourcetype: splunk_web_access + custom_index: _internal From c4a7ae08a0355b5bd2f845c9dcc7039d195165f1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 13 Sep 2023 17:36:26 -0700 Subject: [PATCH 11/89] associated datasets with detections --- .../splunk_absolute_path_traversal_using_runshellscript.yml | 2 +- .../splunk_cmd_injection_using_external_lookups.yml | 6 +++--- .../application/splunk_dos_using_malformed_saml_request.yml | 2 +- .../splunk_reflected_xss_on_app_search_table_endpoint.yml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index 0d6bef11dd..d2db8b1270 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -40,7 +40,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: UPDATE url to dataset + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log source: python.log sourcetype: splunk_python custom_index: _internal diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml index 503afd6058..e10c44def7 100644 --- a/detections/application/splunk_cmd_injection_using_external_lookups.yml +++ b/detections/application/splunk_cmd_injection_using_external_lookups.yml @@ -1,4 +1,4 @@ -name: Splunk cmd injection using external lookups +name: Splunk Cmd Injection Using External Lookups id: 901ae2e2-b47b-4adc-b296-a151a8fccdca version: 1 date: '2023-09-05' @@ -12,7 +12,7 @@ search: '|`audit_searches` search = \"| *runshellscript*\ \ \\\"\\\"\" \n| s how_to_implement: Must have access to internal audit index. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: -- https://advisory.splunk.com/advisories +- https://advisory.splunk.com/advisories/SVD-2023-0807 tags: analytic_story: - Splunk Vulnerabilities @@ -42,7 +42,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: UPDATE url to dataset + - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log source: audittrail sourcetype: audittrail custom_index: _audit diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml index d0c685a13d..93914f4cb0 100644 --- a/detections/application/splunk_dos_using_malformed_saml_request.yml +++ b/detections/application/splunk_dos_using_malformed_saml_request.yml @@ -41,7 +41,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: UPDATE url to dataset + - data: datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log source: splunkd.log sourcetype: splunkd custom_index: _internal \ No newline at end of file diff --git a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml index 1b949c854e..ea472b5d4e 100644 --- a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml +++ b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -44,7 +44,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: UPDATE url to dataset + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_on_app_search_table_endpoint_splunk_web_access.log source: web_access.log sourcetype: splunk_web_access custom_index: _internal From 97019576b016ae001c37c19846717e89829351fa Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 18 Sep 2023 07:38:30 -0700 Subject: [PATCH 12/89] Fix missing macro --- .../application/splunk_cmd_injection_using_external_lookups.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml index e10c44def7..18e2eb621e 100644 --- a/detections/application/splunk_cmd_injection_using_external_lookups.yml +++ b/detections/application/splunk_cmd_injection_using_external_lookups.yml @@ -8,7 +8,7 @@ type: Hunting data_source: - audittrial description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. -search: '|`audit_searches` search = \"| *runshellscript*\ \ \\\"\\\"\" \n| stats earliest(_time) as event_time count by search user splunk_server\n\ | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups`' +search: '|`audit_searches` search = \"| *runshellscript*\ \ \\\"\\\"\" \n| stats earliest(_time) as event_time count by search user splunk_server\n\ | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups_filter`' how_to_implement: Must have access to internal audit index. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: From 0d91f178921d64b0532ad8db4045165a416f0a9f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 18 Sep 2023 07:44:25 -0700 Subject: [PATCH 13/89] fix search typos --- .../splunk_absolute_path_traversal_using_runshellscript.yml | 2 +- .../application/splunk_cmd_injection_using_external_lookups.yml | 2 +- .../splunk_reflected_xss_on_app_search_table_endpoint.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index d2db8b1270..ca40ac3d4f 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -8,7 +8,7 @@ type: Hunting data_source: - python.log description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. -search: '|`splunk_python` *runshellscript* | `splunk_absolute_path_traversal_using_runshellscript_filter`' +search: '`splunk_python` *runshellscript* | `splunk_absolute_path_traversal_using_runshellscript_filter`' how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml index 18e2eb621e..888f3e7161 100644 --- a/detections/application/splunk_cmd_injection_using_external_lookups.yml +++ b/detections/application/splunk_cmd_injection_using_external_lookups.yml @@ -8,7 +8,7 @@ type: Hunting data_source: - audittrial description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. -search: '|`audit_searches` search = \"| *runshellscript*\ \ \\\"\\\"\" \n| stats earliest(_time) as event_time count by search user splunk_server\n\ | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups_filter`' +search: '`audit_searches` search = \"| *runshellscript*\ \ \\\"\\\"\" \n| stats earliest(_time) as event_time count by search user splunk_server\n\ | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups_filter`' how_to_implement: Must have access to internal audit index. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: diff --git a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml index ea472b5d4e..1f138e36db 100644 --- a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml +++ b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -1,4 +1,4 @@ -name: Splunk Reflected XSS on app search table endpoint +name: Splunk Reflected XSS on App Search Table Endpoint id: 182f9080-4137-4629-94ac-cb1083ac981a version: 1 date: '2023-09-05' From e68a8a71458764922bec41f1ed155f70785a71bf Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 18 Sep 2023 08:23:40 -0700 Subject: [PATCH 14/89] fix dataset links --- .../application/splunk_cmd_injection_using_external_lookups.yml | 2 +- .../application/splunk_dos_using_malformed_saml_request.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml index 888f3e7161..6ca14b80dd 100644 --- a/detections/application/splunk_cmd_injection_using_external_lookups.yml +++ b/detections/application/splunk_cmd_injection_using_external_lookups.yml @@ -42,7 +42,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log source: audittrail sourcetype: audittrail custom_index: _audit diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml index 93914f4cb0..c9f5d57882 100644 --- a/detections/application/splunk_dos_using_malformed_saml_request.yml +++ b/detections/application/splunk_dos_using_malformed_saml_request.yml @@ -41,7 +41,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log source: splunkd.log sourcetype: splunkd custom_index: _internal \ No newline at end of file From 7aa6020ad947141badf2ef27b0d306965a669303 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 18 Sep 2023 13:09:11 -0700 Subject: [PATCH 15/89] fix search formatting --- .../splunk_cmd_injection_using_external_lookups.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml index 6ca14b80dd..bde67675e2 100644 --- a/detections/application/splunk_cmd_injection_using_external_lookups.yml +++ b/detections/application/splunk_cmd_injection_using_external_lookups.yml @@ -8,7 +8,8 @@ type: Hunting data_source: - audittrial description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. -search: '`audit_searches` search = \"| *runshellscript*\ \ \\\"\\\"\" \n| stats earliest(_time) as event_time count by search user splunk_server\n\ | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups_filter`' +search: '`audit_searches` search = "| *runshellscript* """ | stats earliest(_time) as event_time count by search user splunk_server + | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups_filter`' how_to_implement: Must have access to internal audit index. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: From b3d34a5bef9db6308eee3a9581bdc7f8d02e74ea Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 19 Sep 2023 10:43:13 +0200 Subject: [PATCH 16/89] njrat2 --- ...ndows_delete_or_modify_system_firewall.yml | 64 ++++++++++++++++ ...s_disable_or_modify_tools_via_taskkill.yml | 73 +++++++++++++++++++ .../windows_fileless_storage_via_registry.yml | 66 +++++++++++++++++ ...ed_module_executable_in_loaded_modules.yml | 65 +++++++++++++++++ .../endpoint/windows_time_based_evasion.yml | 63 ++++++++++++++++ ..._execution_malicious_url_shortcut_file.yml | 1 + 6 files changed, 332 insertions(+) create mode 100644 detections/endpoint/windows_delete_or_modify_system_firewall.yml create mode 100644 detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml create mode 100644 detections/endpoint/windows_fileless_storage_via_registry.yml create mode 100644 detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml create mode 100644 detections/endpoint/windows_time_based_evasion.yml diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml new file mode 100644 index 0000000000..a5487b6bd7 --- /dev/null +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -0,0 +1,64 @@ +name: Windows Delete or Modify System Firewall +id: b188d11a-eba7-419d-b8b6-cc265b4f2c4f +version: 1 +date: '2023-09-08' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon Event ID 1 +description: This analytic identifies potentially malicious 'netsh' processes that manipulate firewall configurations. + This behavior has been observed in the NJRAT malware, which deletes its added firewall rules as part of its cleanup process. + Leveraging this anomaly detection can be a valuable approach for detecting malware, such as NJRAT, + that makes alterations to firewall configurations as a component of its malicious activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "netsh.exe" Processes.process = "* firewall *" Processes.process = "* delete *" + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_delete_or_modify_system_firewall_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: administrator may modify or delete firewall configuration. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a $process_name$ delete firewall configuration in $dest$ + mitre_attack_id: + - T1562 + - T1562.004 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml new file mode 100644 index 0000000000..4870979efd --- /dev/null +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -0,0 +1,73 @@ +name: Windows Disable or Modify Tools Via Taskkill +id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 +version: 1 +date: '2023-09-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon Event ID 1 +description: This analytic is designed to identify potentially malicious processes that terminate other processes using 'taskkill.exe'. + This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate + other processes—whether they be security products or other legitimate applications—as part of their malicious activities. + Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_or_modify_tools_via_taskkill_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: network administrator can use this application to kill process during audit or investigation. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a taskkill process to terminate process is executed in $dest$ + mitre_attack_id: + - T1562 + - T1562.001 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: dest + type: Endpoint + role: + - Victim + - name: parent_process_name + type: Process Name + role: + - Parent Process + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill/taskkill_im.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_fileless_storage_via_registry.yml b/detections/endpoint/windows_fileless_storage_via_registry.yml new file mode 100644 index 0000000000..8bb082b93a --- /dev/null +++ b/detections/endpoint/windows_fileless_storage_via_registry.yml @@ -0,0 +1,66 @@ +name: Windows Njrat Fileless Storage via Registry +id: a5fffbbd-271f-4980-94ed-4fbf17f0af1c +version: 1 +date: '2023-09-14' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of a suspicious registry modification associated with NjRat, + a telltale sign of its fileless technique. NjRat employs this method to manage its keylogs and execute downloaded DLL module plugins discreetly on the compromised host. + This approach is particularly effective at evading conventional file-based detection systems, as it stores indicators of compromise (IOCs) in the registry. + Leveraging this TTP (Tactics, Techniques, and Procedures) detection can significantly enhance the identification of NjRAT infections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\[kl]" OR Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name Registry.registry_value_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_njrat_fileless_storage_via_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: unknown +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 100 + impact: 100 + message: a suspicious registry entry related to NjRAT keylloging registry in $dest$ + mitre_attack_id: + - T1027.011 + - T1027 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.011/njrat_fileless_registry_entry/njrat_registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml b/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml new file mode 100644 index 0000000000..16d00138d0 --- /dev/null +++ b/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml @@ -0,0 +1,65 @@ +name: Windows Shared Module Executable in loaded Modules +id: 3e27af56-fcf0-4113-988d-24969b062be7 +version: 1 +date: '2023-09-12' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 7 +description: This analytic identifies potentially malicious 'ImageLoaded' events, particularly when they involve executable files. + This behavior was observed in NjRAT instances, where, during each instance of loading a module from its C2 server onto the compromised host, + Sysmon recorded the path of the actual Image or Process as an 'ImageLoaded' event, rather than the typical tracking of dynamically loaded DLL modules in memory. + This event holds significance because it tracks processes that load modules and libraries, which are typically in the .dll format rather than .exe. + Leveraging this 'Time-To-Perform' (TTP) detection method can prove invaluable for the identification of NjRAT malware or + other malicious software instances that introduce executable files as modules within a targeted host. +search: '`sysmon` EventCode=7 ImageLoaded= *.exe + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_shared_module_executable_in_loaded_modules_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown. +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 80 + impact: 80 + message: an executable as Imageloaded by $Image$ in $dest$ + mitre_attack_id: + - T1129 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - Image + - ImageLoaded + - Signed + - SignatureStatus + - OriginalFileName + - process_name + - Computer + - EventCode + - ProcessId + - Hashes + - IMPHASH + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml new file mode 100644 index 0000000000..aa19c7bbfb --- /dev/null +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -0,0 +1,63 @@ +name: Windows Time Based Evasion +id: 34502357-deb1-499a-8261-ffe144abf561 +version: 1 +date: '2023-09-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 1 +description: This analytic is designed to detect potentially malicious processes that initiate a ping delay using an invalid IP address. + This evasion technique was observed in NJRAT, where the malware employed ping commands as a means to introduce a time delay before self-deletion on the compromised host. + Identifying this (TTP) behavior can serve as a valuable indicator for detecting NJRAT infections or other malware that employ time delays as + evasion tactics. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "ping.exe" Processes.parent_process = "* ping 0 -n *" OR Processes.process = "* ping 0 -n *" + by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_time_based_evasion_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a $process_name$ did a suspicious ping to invalid ip address in $dest$ + mitre_attack_id: + - T1497 + - T1497.003 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index 9f5626715e..8ed17315dd 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Chaos Ransomware + - NjRAT asset_type: Endpoint confidence: 80 impact: 80 From 677b3313fa99b0c20f65e5b100c3e286fa688e18 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:52:03 +0200 Subject: [PATCH 17/89] Update windows_time_based_evasion.yml --- detections/endpoint/windows_time_based_evasion.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index aa19c7bbfb..00b5693c1e 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -55,6 +55,7 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id + security_domain: endpoint tests: - name: True Positive Test attack_data: From 36f93918576cfd813103dd1d3f1d84936b5d116c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:52:57 +0200 Subject: [PATCH 18/89] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../endpoint/windows_disable_or_modify_tools_via_taskkill.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index 4870979efd..b89477b392 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -7,7 +7,7 @@ status: production type: Anomaly data_source: - Sysmon Event ID 1 -description: This analytic is designed to identify potentially malicious processes that terminate other processes using 'taskkill.exe'. +description: This analytic is designed to identify potentially malicious processes that terminate other processes using "taskkill.exe". This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate other processes—whether they be security products or other legitimate applications—as part of their malicious activities. Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. From d6c314af41da560e5e67e0f9e9ce7a556509cb0f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:55:21 +0200 Subject: [PATCH 19/89] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../endpoint/windows_disable_or_modify_tools_via_taskkill.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index b89477b392..14a5c89312 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -7,7 +7,7 @@ status: production type: Anomaly data_source: - Sysmon Event ID 1 -description: This analytic is designed to identify potentially malicious processes that terminate other processes using "taskkill.exe". +description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe. This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate other processes—whether they be security products or other legitimate applications—as part of their malicious activities. Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. From 6db976f90c31b820b233fbe56831cb6a9a1c866a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 10:59:23 +0200 Subject: [PATCH 20/89] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../windows_disable_or_modify_tools_via_taskkill.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index 14a5c89312..c9a8faee16 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -7,9 +7,9 @@ status: production type: Anomaly data_source: - Sysmon Event ID 1 -description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe. - This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate - other processes—whether they be security products or other legitimate applications—as part of their malicious activities. +description: This analytic is designed to identify potentially malicious processes that terminate other processes using taskkill.exe. + This technique has been observed in various malware instances, employed by adversaries and red teamers alike, to forcibly terminate + other processes whether they be security products or other legitimate applications as part of their malicious activities. Detecting this anomaly serves as a valuable alert mechanism to identify suspicious processes or malware attempting to evade detection and disrupt system stability. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") From 82b16516681d3376a5b09c13b4d95bf21bc3bea8 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 19 Sep 2023 11:38:39 +0200 Subject: [PATCH 21/89] Update windows_fileless_storage_via_registry.yml --- detections/endpoint/windows_fileless_storage_via_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_fileless_storage_via_registry.yml b/detections/endpoint/windows_fileless_storage_via_registry.yml index 8bb082b93a..ac41e4b87e 100644 --- a/detections/endpoint/windows_fileless_storage_via_registry.yml +++ b/detections/endpoint/windows_fileless_storage_via_registry.yml @@ -9,7 +9,7 @@ data_source: - Sysmon EventID 12 - Sysmon EventID 13 - Sysmon EventID 14 -description: The following analytic identifies a suspicious registry modification of a suspicious registry modification associated with NjRat, +description: The following analytic identifies a suspicious registry modification associated with NjRat, a telltale sign of its fileless technique. NjRat employs this method to manage its keylogs and execute downloaded DLL module plugins discreetly on the compromised host. This approach is particularly effective at evading conventional file-based detection systems, as it stores indicators of compromise (IOCs) in the registry. Leveraging this TTP (Tactics, Techniques, and Procedures) detection can significantly enhance the identification of NjRAT infections. From 8a8f5949e5bf050733fe0673d3223fd435f648c1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Sep 2023 14:35:11 -0700 Subject: [PATCH 22/89] updating type --- .../cloud/azure_ad_user_enabled_and_password_reset.yml | 10 +++++----- ...ct_certify_with_powershell_script_block_logging.yml | 2 +- ...s_steal_authentication_certificates___esc1_auth.yml | 4 ++-- ...ows_suspect_process_with_authentication_traffic.yml | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index 0ea877c255..2399b3bfef 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -14,8 +14,8 @@ search: ' `azuread` (operationName="Enable account" OR operationName="Reset pass OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m | rename properties.* as * | rename targetResources{}.userPrincipalName - as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName, + as user | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(operationName) values(initiatedBy) as initiatedBy by _time, user, result | `azure_ad_user_enabled_and_password_reset_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). @@ -36,12 +36,12 @@ tags: mitre_attack_id: - T1098 observable: - - name: userPrincipalName - type: User Name + - name: user + type: User role: - Victim - name: initiatedBy - type: User Name + type: User role: - Attacker product: diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml index 82999f056a..a49a723f23 100644 --- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml @@ -39,7 +39,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: command diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml index 9197b58229..1252e1fa58 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml @@ -57,11 +57,11 @@ tags: role: - Victim - name: src_user - type: User Name + type: User role: - Victim - name: user - type: User Name + type: User role: - Victim - name: ssl_hash diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index 8fb98fd699..c63a41940f 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -55,7 +55,7 @@ tags: role: - Victim - name: user - type: User Name + type: User role: - Victim - name: process_name From 1d35e003666a659ccde4e2613ec040e06643f694 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Sep 2023 15:17:24 -0700 Subject: [PATCH 23/89] testing a change for sysmon --- change.py | 50 +++++++++++++++++++ .../detect_mimikatz_using_loaded_images.yml | 10 ++-- .../dump_lsass_via_procdump_rename.yml | 4 +- .../unsigned_image_loaded_by_lsass.yml | 4 +- .../access_lsass_memory_for_dump_creation.yml | 6 +-- .../endpoint/cmlua_or_cmstplua_uac_bypass.yml | 4 +- .../endpoint/cobalt_strike_named_pipes.yml | 4 +- ...ate_remote_thread_in_shell_application.yml | 8 +-- .../create_remote_thread_into_lsass.yml | 6 +-- .../creation_of_lsass_dump_with_taskmgr.yml | 8 +-- ...redential_dumping_through_lsass_access.yml | 10 ++-- .../detect_regasm_with_network_connection.yml | 6 +-- ...detect_regsvcs_with_network_connection.yml | 6 +-- ...ect_wmi_event_subscription_persistence.yml | 4 +- .../download_files_using_telegram.yml | 6 +-- .../endpoint/drop_icedid_license_dat.yml | 6 +-- ...ve_file_deletion_in_windefender_folder.yml | 8 +-- .../excessive_usage_of_nslookup_app.yml | 10 ++-- .../excessive_usage_of_sc_service_utility.yml | 6 +-- .../high_process_termination_frequency.yml | 8 +-- ...did_exfiltrated_archived_file_creation.yml | 8 +-- .../endpoint/loading_of_dynwrapx_module.yml | 8 +-- .../endpoint/modification_of_wallpaper.yml | 4 +- ..._scripting_process_loading_ldap_module.yml | 4 +- ...s_scripting_process_loading_wmi_module.yml | 4 +- .../mshtml_module_load_in_office_product.yml | 4 +- ...msi_module_loaded_by_non_system_binary.yml | 6 +-- ...office_document_creating_schedule_task.yml | 4 +- .../office_document_executing_macro_code.yml | 4 +- ...remote_thread_to_known_windows_process.yml | 8 +-- ...process_deleting_its_process_file_path.yml | 8 +-- .../ransomware_notes_bulk_creation.yml | 8 +-- ...ticket_exports_through_winlogon_access.yml | 6 +-- ...ll32_create_remote_thread_to_a_process.yml | 8 +-- ...rundll32_createremotethread_in_browser.yml | 8 +-- detections/endpoint/rundll32_dnsquery.yml | 8 +-- ..._by_app_connect_and_create_adsi_object.yml | 8 +-- .../spoolsv_suspicious_loaded_modules.yml | 8 +-- .../spoolsv_suspicious_process_access.yml | 6 +-- .../endpoint/sqlite_module_in_temp_folder.yml | 4 +- .../suspicious_driver_loaded_path.yml | 8 +-- ...ess_dns_query_known_abuse_web_services.yml | 8 +-- ...picious_process_with_discord_dns_query.yml | 8 +-- detections/endpoint/trickbot_named_pipe.yml | 8 +-- .../uac_bypass_mmc_load_unsigned_dll.yml | 8 +-- .../uac_bypass_with_colorui_com_object.yml | 8 +-- .../wbemprox_com_object_execution.yml | 8 +-- ...ss_connecting_to_ip_check_web_services.yml | 4 +- ...lation_winlogon_duplicate_token_handle.yml | 8 +-- ...ogon_duplicate_handle_in_uncommon_path.yml | 6 +-- ...ws_app_layer_protocol_qakbot_namedpipe.yml | 8 +-- ...r_protocol_wermgr_connect_to_namedpipe.yml | 8 +-- ...yer_protocol_rms_radmin_tool_namedpipe.yml | 6 +-- ...truction_recursive_exec_files_deletion.yml | 8 +-- ...earch_order_hijacking_hunt_with_sysmon.yml | 2 +- .../windows_dll_side_loading_in_calc.yml | 8 +-- .../windows_drivers_loaded_by_signature.yml | 8 +-- ...er_protocol_in_non_common_process_path.yml | 8 +-- ...indows_gather_victim_identity_sam_info.yml | 8 +-- ...ork_info_through_ip_check_web_services.yml | 8 +-- .../windows_high_file_deletion_frequency.yml | 8 +-- ...k_execution_flow_version_dll_side_load.yml | 8 +-- ...hunting_system_account_targeting_lsass.yml | 6 +-- ..._input_capture_using_credential_ui_dll.yml | 8 +-- .../windows_installutil_credential_theft.yml | 4 +- ...il_protocol_in_non_common_process_path.yml | 8 +-- .../windows_mark_of_the_web_bypass.yml | 4 +- ...dows_multi_hop_proxy_tor_website_query.yml | 8 +-- ...ows_non_system_account_targeting_lsass.yml | 6 +-- .../windows_possible_credential_dumping.yml | 6 +-- ...s_injection_of_wermgr_to_known_browser.yml | 8 +-- ...indows_process_injection_remote_thread.yml | 8 +-- ...cess_injection_with_public_source_path.yml | 8 +-- ...ws_raw_access_to_disk_volume_partition.yml | 4 +- ...raw_access_to_master_boot_record_drive.yml | 6 +-- ...remote_access_software_brc4_loaded_dll.yml | 8 +-- ...hment_connect_to_none_ms_office_domain.yml | 8 +-- .../windows_terminating_lsass_process.yml | 4 +- .../windows_unsigned_dll_side_loading.yml | 4 +- .../windows_vulnerable_3cx_software.yml | 4 +- .../windows_wmi_impersonate_token.yml | 6 +-- detections/endpoint/xmrig_driver_loaded.yml | 8 +-- 82 files changed, 319 insertions(+), 269 deletions(-) create mode 100644 change.py diff --git a/change.py b/change.py new file mode 100644 index 0000000000..dfd51827b7 --- /dev/null +++ b/change.py @@ -0,0 +1,50 @@ +import os +import re + +# Directory containing YAML files +directory_path = "/Users/bpatel/Research/malware/splunk_github/security_content/detections" + +# Iterate through each file in the directory and its subdirectories +for dirpath, dirnames, filenames in os.walk(directory_path): + for filename in filenames: + if filename.endswith('.yml'): + filepath = os.path.join(dirpath, filename) + + # Open and read the YAML file as text + with open(filepath, 'r') as f: + content = f.read() + + # Check if the data source contains "Powershell 4104" + if "`sysmon`" in content: + # print(type(content)) + + pattern1 = r'\bComputer\b' + pattern2 = r'$Computer\$' + r1 = 'dest' + r2 = '$dest$' + + content = re.sub(pattern1, r1, content) + content = re.sub(pattern2, r2, content) + + # # Add `| windows_rename_to_cim` before `| stats` + # content = content.replace('Computer ', 'dest') + # content = content.replace('$Computer$', '$dest$') + # content = content.replace('$Computer$', '$dest$') + + # # In the `| stats` command, rename Computer to dest and UserID to user + # content = content.replace('by EventCode ScriptBlockText Computer UserID', + # 'by EventCode ScriptBlockText dest user') + + # # Update the observable section + # content = content.replace('name: Computer', 'name: dest') + # content = content.replace('name: UserID', 'name: user') + + # # Update the required_fields section + # content = content.replace('- Computer\n', '- dest\n') + # content = content.replace('- UserID\n', '- user\n') + + # Write the modified content back to the YAML file + with open(filepath, 'w') as f: + f.write(content) + +print("Finished updating YAML files.") \ No newline at end of file diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/detections/deprecated/detect_mimikatz_using_loaded_images.yml index f7eb47d242..4efe0407e3 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/detections/deprecated/detect_mimikatz_using_loaded_images.yml @@ -11,9 +11,9 @@ description: This search looks for reading loaded Images unique to credential du data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId) - as ProcessId by Computer, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll + as ProcessId by dest, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename - Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mimikatz_using_loaded_images_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named @@ -40,7 +40,7 @@ tags: confidence: 80 impact: 80 message: A process, $Image$, has loaded $ImageLoaded$ that are typically related - to credential dumping on $Computer$. Review for further details. + to credential dumping on $dest$. Review for further details. mitre_attack_id: - T1003.001 - T1003 @@ -49,7 +49,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim @@ -70,7 +70,7 @@ tags: - EventCode - ImageLoaded - ProcessId - - Computer + - dest - Image risk_score: 64 security_domain: endpoint diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml index 6820afd9da..b8185cb381 100644 --- a/detections/deprecated/dump_lsass_via_procdump_rename.yml +++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml @@ -17,7 +17,7 @@ description: 'Detect a renamed instance of procdump.exe dumping the lsass proces data_source: - Sysmon Event ID 1 search: '`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 - (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename Computer as + (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename dest as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`' @@ -64,7 +64,7 @@ tags: - process_name - EventID - CommandLine - - Computer + - dest - parent_process_name risk_score: 80 security_domain: endpoint diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/detections/deprecated/unsigned_image_loaded_by_lsass.yml index ba81b78806..c575f8f769 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/detections/deprecated/unsigned_image_loaded_by_lsass.yml @@ -10,8 +10,8 @@ description: This search detects loading of unsigned images by LSASS. Deprecated data_source: - Sysmon Event ID 7 search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time) - as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 - | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + as firstTime max(_time) as lastTime by dest, Image, ImageLoaded, Signed, SHA1 + | rename dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `unsigned_image_loaded_by_lsass_filter` ' how_to_implement: This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`. diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index e78f2ab86d..d7706eee51 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -9,8 +9,8 @@ description: The following analytic is designed to detect potentially malicious data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, - TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| + | stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage, + TargetProcessId, SourceImage, SourceProcessId | rename dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` ' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. @@ -53,7 +53,7 @@ tags: - EventCode - TargetImage - CallTrace - - Computer + - dest - TargetProcessId - SourceImage - SourceProcessId diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index 693ad67b71..be8bcb32bc 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -13,7 +13,7 @@ data_source: search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime - by dest Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` + by dest Image ImageLoaded process_name dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -49,7 +49,7 @@ tags: - Image - ImageLoaded - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 5433cd8edb..3ff02ea6f5 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -22,7 +22,7 @@ data_source: search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*, \\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime - by Computer, process_name, process_id process_path, PipeName | rename Computer as + by dest, process_name, process_id process_path, PipeName | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -70,7 +70,7 @@ tags: - _time - EventID - PipeName - - Computer + - dest - process_name - process_path - process_id diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index ee0424a20e..ced72a63b5 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -13,7 +13,7 @@ data_source: - Sysmon Event ID 8 search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId - SourceProcessId EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)` + SourceProcessId EventCode StartAddress SourceImage dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -31,11 +31,11 @@ tags: confidence: 100 impact: 70 message: process $SourceImage$ create a remote thread to shell app process $TargetImage$ - in host $Computer$ + in host $dest$ mitre_attack_id: - T1055 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -55,7 +55,7 @@ tags: - SourceProcessId - StartAddress - EventCode - - Computer + - dest risk_score: 70 security_domain: endpoint tests: diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index 2e74c5ef1d..d04a766ac1 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -9,8 +9,8 @@ description: The following analytic developed to detect potential credential dum data_source: - Sysmon Event ID 8 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime - max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename - Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + max(_time) as lastTime by dest, EventCode, TargetImage, TargetProcessId | rename + dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter`' how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. @@ -50,7 +50,7 @@ tags: - _time - EventID - TargetImage - - Computer + - dest - EventCode - TargetImage - TargetProcessId diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 6210db1fbd..af9a53d857 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -13,8 +13,8 @@ description: Detect the hands on keyboard behavior of Windows Task Manager creat data_source: - Sysmon Event ID 1 search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp | - stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, - process_name, TargetFilename | rename Computer as dest | `security_content_ctime(firstTime)` + stats count min(_time) as firstTime max(_time) as lastTime by dest, object_category, + process_name, TargetFilename | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an @@ -35,7 +35,7 @@ tags: asset_type: Windows confidence: 100 impact: 80 - message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ + message: $process_name$ was identified on endpoint $dest$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. mitre_attack_id: - T1003.001 @@ -58,7 +58,7 @@ tags: - EventID - process_name - TargetFilename - - Computer + - dest - object_category risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 087481964b..1664a3f30c 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -10,9 +10,9 @@ description: This search looks for reading lsass memory consistent with credenti data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, + | stats count min(_time) as firstTime max(_time) as lastTime by dest, SourceImage, SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename - Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_credential_dumping_through_lsass_access_filter` ' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. @@ -33,7 +33,7 @@ tags: confidence: 100 impact: 80 message: The $source_image$ has attempted access to read $TargetImage$ was identified - on endpoint $Computer$, this is indicative of credential dumping and should be + on endpoint $dest$, this is indicative of credential dumping and should be investigated. mitre_attack_id: - T1003.001 @@ -43,7 +43,7 @@ tags: type: Other role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim @@ -60,7 +60,7 @@ tags: - EventCode - TargetImage - GrantedAccess - - Computer + - dest - SourceImage - SourceProcessId - TargetImage diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index 78b7249d1d..c8cdb3b357 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -18,7 +18,7 @@ description: The following analytic identifies regasm.exe with a network connect data_source: - Sysmon Event ID 3 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 - process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime + process_name=regasm.exe | rename dest as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -40,7 +40,7 @@ tags: confidence: 100 impact: 80 message: An instance of $process_name$ contacting a remote destination was identified - on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. + on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$. mitre_attack_id: - T1218 - T1218.009 @@ -66,7 +66,7 @@ tags: - EventID - dest_ip - process_name - - Computer + - dest - user - src_ip - dest_host diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index 7bcae617d9..bd72db0e00 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -18,7 +18,7 @@ description: The following analytic identifies Regsvcs.exe with a network connec data_source: - Sysmon Event ID 3 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 - process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime + process_name=regsvcs.exe | rename dest as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -40,7 +40,7 @@ tags: confidence: 100 impact: 80 message: An instance of $process_name$ contacting a remote destination was identified - on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. + on endpoint $dest$ by user $user$. This behavior is not normal for $process_name$. mitre_attack_id: - T1218 - T1218.009 @@ -66,7 +66,7 @@ tags: - EventID - dest_ip - process_name - - Computer + - dest - user - src_ip - dest_host diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index f0e4eb89f0..bc8738b6c6 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -28,7 +28,7 @@ description: 'The following analytic identifies the use of WMI Event Subscriptio data_source: - Sysmon Event ID 20 search: '`sysmon` EventID=20 | stats count min(_time) as firstTime max(_time) as lastTime - by Computer User Destination | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by dest User Destination | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_wmi_event_subscription_persistence_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using @@ -64,7 +64,7 @@ tags: required_fields: - _time - Destination - - Computer + - dest - User risk_score: 63 security_domain: endpoint diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 800cece212..b695634e94 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -13,7 +13,7 @@ description: The following analytic will identify a suspicious download by the T data_source: - Sysmon Event ID 15 search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" - |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode + |stats count min(_time) as firstTime max(_time) as lastTime by dest EventCode Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -40,7 +40,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim @@ -50,7 +50,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - EventCode - Image - process_id diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index 660afbd740..9018681bdf 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 11 search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) - as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + as lastTime by TargetFilename EventCode process_id process_name dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -27,12 +27,12 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + message: process $SourceImage$ create a file $TargetImage$ in host $dest$ mitre_attack_id: - T1204 - T1204.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index c6482b97fe..11120b0e82 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 23 search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime - max(_time) as lastTime count by user EventCode Image ProcessID Computer |where count + max(_time) as lastTime count by user EventCode Image ProcessID dest |where count >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_file_deletion_in_windefender_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -33,7 +33,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: High frequency file deletion activity detected on host $Computer$ + message: High frequency file deletion activity detected on host $dest$ mitre_attack_id: - T1485 observable: @@ -41,7 +41,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -57,7 +57,7 @@ tags: - _time - EventCode - TargetFilename - - Computer + - dest - user - Image - ProcessID diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 41ab84599f..4680328347 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -14,8 +14,8 @@ description: This search is to detect potential DNS exfiltration using nslookup data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=1m - | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as - avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | + | stats count as numNsLookup by dest, _time | eventstats avg(numNsLookup) as + avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by dest | eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' @@ -37,12 +37,12 @@ tags: asset_type: Endpoint confidence: 70 impact: 40 - message: Excessive usage of nslookup.exe has been detected on $Computer$. This detection + message: Excessive usage of nslookup.exe has been detected on $dest$. This detection is triggered as as it violates the dynamic threshold mitre_attack_id: - T1048 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -52,7 +52,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - process_name - EventCode risk_score: 28 diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index fa530484ea..3de8764d66 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -12,8 +12,8 @@ description: This search is to detect a suspicious excessive usage of sc.exe in data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | - stats values(process) as process count as numScExe by Computer, _time | eventstats - avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer + stats values(process) as process count as numScExe by dest, _time | eventstats + avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by dest | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`' @@ -37,7 +37,7 @@ tags: - T1569 - T1569.002 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index de642be9aa..355fd1457d 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -13,7 +13,7 @@ description: This analytic is designed to identify a high frequency of process t data_source: - Sysmon Event ID 5 search: '`sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated - min(_time) as firstTime max(_time) as lastTime count by _time Computer EventCode + min(_time) as firstTime max(_time) as lastTime count by _time dest EventCode ProcessID | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `high_process_termination_frequency_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -32,11 +32,11 @@ tags: confidence: 80 impact: 90 message: High frequency process termination (more than 15 processes within 3s) detected - on host $Computer$ + on host $dest$ mitre_attack_id: - T1486 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -51,7 +51,7 @@ tags: required_fields: - EventCode - Image - - Computer + - dest - _time - ProcessID risk_score: 72 diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 71682a28b8..03eff385aa 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 11 search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by - TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + TargetFilename EventCode process_id process_name dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -27,12 +27,12 @@ tags: asset_type: Endpoint confidence: 90 impact: 80 - message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + message: process $SourceImage$ create a file $TargetImage$ in host $dest$ mitre_attack_id: - T1560.001 - T1560 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -50,7 +50,7 @@ tags: - EventCode - process_id - process_name - - Computer + - dest risk_score: 72 security_domain: endpoint tests: diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 4e640260e7..b067e89407 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -18,7 +18,7 @@ data_source: search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name - Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from @@ -43,12 +43,12 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: dynwrapx.dll loaded by process $process_name$ on $Computer$ + message: dynwrapx.dll loaded by process $process_name$ on $dest$ mitre_attack_id: - T1055 - T1055.001 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -63,7 +63,7 @@ tags: - OriginalFileName - Product - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 424ad85899..13d7e6d712 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -14,7 +14,7 @@ data_source: search: '`sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode Image TargetObject Details Computer process_guid process_id + lastTime by EventCode Image TargetObject Details dest process_guid process_id user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -54,7 +54,7 @@ tags: - Image - TargetObject - Details - - Computer + - dest - process_guid - process_id - user_id diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 1f276f2db6..da086fe10b 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -17,7 +17,7 @@ data_source: search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid - Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -54,7 +54,7 @@ tags: - process_name - ProcessId - ProcessGuid - - Computer + - dest - ImageLoaded risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index fe6d3352c4..969299c459 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -17,7 +17,7 @@ data_source: search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) - as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer + as lastTime count by Image EventCode process_name ProcessId ProcessGuid dest ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -55,7 +55,7 @@ tags: - process_name - ProcessId - ProcessGuid - - Computer + - dest - ImageLoaded risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index d2cfe95ce0..3cb3073e3b 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -14,8 +14,8 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", "msaccess.exe","Graph.exe","winproj.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, - ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name, + ImageLoaded, OriginalFileName, ProcessGuid | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index f8f2e94605..0cd85a1380 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -27,7 +27,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by - Image ImageLoaded process_name Computer EventCode ProcessId | `security_content_ctime(firstTime)` + Image ImageLoaded process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msi_module_loaded_by_non_system_binary_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -49,7 +49,7 @@ tags: - CVE-2021-41379 impact: 80 message: The following module $ImageLoaded$ was loaded by $Image$ outside of the - normal system paths on endpoint $Computer$, potentally related to DLL side-loading. + normal system paths on endpoint $dest$, potentally related to DLL side-loading. mitre_attack_id: - T1574.002 - T1574 @@ -67,7 +67,7 @@ tags: - Image - ImageLoaded - process_name - - Computer + - dest - EventCode - ProcessId risk_score: 56 diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index f8386330f4..f2f2aba012 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -23,7 +23,7 @@ data_source: search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", "msaccess.exe") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime - max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode + max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by dest EventCode Image parent_process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -57,7 +57,7 @@ tags: required_fields: - ImageLoaded - AllImageLoaded - - Computer + - dest - EventCode - Image - process_name diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 0cf90b3f2d..b142464498 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -18,7 +18,7 @@ search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE" "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count - by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` + by dest EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. @@ -60,7 +60,7 @@ tags: required_fields: - ImageLoaded - AllImageLoaded - - Computer + - dest - EventCode - Image - process_name diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index c7d6ed0e18..c09b5614d7 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -16,7 +16,7 @@ search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "p TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress - Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are @@ -32,11 +32,11 @@ tags: confidence: 90 impact: 70 message: A suspicious powershell process $process_name$ that tries to create a remote - thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ + thread on target process $TargetImage$ with eventcode $EventCode$ in host $dest$ mitre_attack_id: - T1055 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -58,7 +58,7 @@ tags: - TargetProcessId - NewThreadId - StartAddress - - Computer + - dest - EventCode risk_score: 63 security_domain: endpoint diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index babbb462ed..6b1eac9f98 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" | eval result = if(like(process,"%".parent_process."%"), "Found", - "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by Computer + "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by dest user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`' @@ -38,11 +38,11 @@ tags: confidence: 100 impact: 60 message: A process $Image$ tries to delete its process path in commandline $cmdline$ - as part of defense evasion in host $Computer$ + as part of defense evasion in host $dest$ mitre_attack_id: - T1070 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -56,7 +56,7 @@ tags: - Splunk Cloud required_fields: - EventCode - - Computer + - dest - user - ParentImage - ParentCommandLine diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index a35453c811..03ab374497 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) - as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer + as unique_readme_path_count values(TargetFilename) as list_of_readme_path by dest Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity @@ -36,11 +36,11 @@ tags: confidence: 90 impact: 90 message: A high frequency file creation of $file_name$ in different file path in - host $Computer$ + host $dest$ mitre_attack_id: - T1486 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -57,7 +57,7 @@ tags: - file_name - _time - TargetFilename - - Computer + - dest - Image - user risk_score: 81 diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 8c4641e56e..ab8fe06257 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -21,8 +21,8 @@ search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time) - as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage, - TargetProcessId, EventCode, GrantedAccess | rename Computer as dest | `security_content_ctime(firstTime)`| + as firstTime max(_time) as lastTime by dest, SourceImage, SourceProcessId, TargetImage, + TargetProcessId, EventCode, GrantedAccess | rename dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly @@ -63,7 +63,7 @@ tags: - EventCode - TargetImage - CallTrace - - Computer + - dest - TargetProcessId - SourceImage - SourceProcessId diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index cd6aab98e4..6c992802fd 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -13,7 +13,7 @@ data_source: - Sysmon Event ID 8 search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage - TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` + TargetProcessId SourceProcessId StartAddress EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints @@ -30,11 +30,11 @@ tags: confidence: 80 impact: 70 message: rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ - in host $Computer$ + in host $dest$ mitre_attack_id: - T1055 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -54,7 +54,7 @@ tags: - SourceProcessId - StartAddress - EventCode - - Computer + - dest risk_score: 56 security_domain: endpoint tests: diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index f511192356..3365424c33 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -14,7 +14,7 @@ data_source: search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId - StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + StartAddress EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_createremotethread_in_browser_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints @@ -31,11 +31,11 @@ tags: confidence: 100 impact: 70 message: rundl32 process $SourceImage$ create a remote thread to browser process - $TargetImage$ in host $Computer$ + $TargetImage$ in host $dest$ mitre_attack_id: - T1055 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -55,7 +55,7 @@ tags: - SourceProcessId - StartAddress - EventCode - - Computer + - dest risk_score: 70 security_domain: endpoint tests: diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index 9ec4e915ef..30cd59cd5a 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -13,7 +13,7 @@ description: This search is to detect a suspicious rundll32.exe process having a data_source: - Sysmon Event ID 22 search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) - as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId Computer + as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. @@ -30,12 +30,12 @@ tags: confidence: 80 impact: 70 message: rundll32 process $process_name$ having a dns query to $QueryName$ in host - $Computer$ + $dest$ mitre_attack_id: - T1218 - T1218.011 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -53,7 +53,7 @@ tags: - QueryName - QueryStatus - ProcessId - - Computer + - dest risk_score: 56 security_domain: endpoint tests: diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml index e5ba6ac518..d9d8831f4a 100644 --- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -19,7 +19,7 @@ data_source: search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name - Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schcache_change_by_app_connect_and_create_adsi_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -36,12 +36,12 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: process $Image$ create a file $TargetFilename$ in host $Computer$ + message: process $Image$ create a file $TargetFilename$ in host $dest$ mitre_attack_id: - T1087.002 - T1087 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -56,7 +56,7 @@ tags: - EventCode - process_id - process_name - - Computer + - dest risk_score: 25 security_domain: endpoint tests: diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 1d85834aed..9d494c245f 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) - as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer + as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image dest ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -30,12 +30,12 @@ tags: - CVE-2021-34527 impact: 80 message: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ - on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. + on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. mitre_attack_id: - T1547.012 - T1547 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -55,7 +55,7 @@ tags: required_fields: - _time - Image - - Computer + - dest - EventCode - ImageLoaded risk_score: 72 diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index 7590a3d1eb..10abf4d645 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | - stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage + stats count min(_time) as firstTime max(_time) as lastTime by dest SourceImage TargetImage GrantedAccess CallTrace EventCode ProcessID| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -36,11 +36,11 @@ tags: - CVE-2021-34527 impact: 80 message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint - $Computer$. This behavior is suspicious and related to PrintNightmare. + $dest$. This behavior is suspicious and related to PrintNightmare. mitre_attack_id: - T1068 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index c611f7c900..9bed595dd4 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -29,11 +29,11 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + message: process $SourceImage$ create a file $TargetImage$ in host $dest$ mitre_attack_id: - T1005 observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index a963f6ed94..a34fd82972 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -17,7 +17,7 @@ data_source: - Sysmon Event ID 6 search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as - firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature + firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -37,12 +37,12 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: Suspicious driver $ImageLoaded$ on $Computer$ + message: Suspicious driver $ImageLoaded$ on $dest$ mitre_attack_id: - T1543.003 - T1543 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -56,7 +56,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - ImageLoaded - Hashes - IMPHASH diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 22bea94be5..65e9104488 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -17,7 +17,7 @@ data_source: search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image - QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` + QueryName QueryStatus process_name QueryResults dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. @@ -35,12 +35,12 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ + message: suspicious process $process_name$ has a dns query in $QueryName$ on $dest$ mitre_attack_id: - T1059.005 - T1059 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -59,7 +59,7 @@ tags: - QueryStatus - process_name - QueryResults - - Computer + - dest risk_score: 64 security_domain: endpoint tests: diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 8d88afd54f..5d9406c690 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -15,7 +15,7 @@ data_source: search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name - QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + QueryResults dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`' how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query. known_false_positives: Noise and false positive can be seen if the following instant @@ -32,12 +32,12 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ + message: suspicious process $process_name$ has a dns query in $QueryName$ on $dest$ mitre_attack_id: - T1059.005 - T1059 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -56,7 +56,7 @@ tags: - QueryStatus - process_name - QueryResults - - Computer + - dest risk_score: 64 security_domain: endpoint tests: diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index cf1c1d7c39..3fb57b83c1 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -10,7 +10,7 @@ description: this search is to detect potential trickbot infection through the c c2 to post or get command during infection. data_source: [] search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats min(_time) - as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName + as firstTime max(_time) as lastTime count by dest user_id EventCode PipeName signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -26,11 +26,11 @@ tags: asset_type: Endpoint confidence: 60 impact: 70 - message: Possible Trickbot namedpipe created on $Computer$ by $Image$ + message: Possible Trickbot namedpipe created on $dest$ by $Image$ mitre_attack_id: - T1055 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -44,7 +44,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - user_id - EventCode - PipeName diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index 1aec04f65d..89b57fb244 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -13,7 +13,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" | stats count min(_time) as firstTime max(_time) - as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName Computer EventCode + as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName dest EventCode Company | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_mmc_load_unsigned_dll_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -29,14 +29,14 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ + message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $dest$ with EventCode $EventCode$ mitre_attack_id: - T1548.002 - T1548 - T1218.014 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -51,7 +51,7 @@ tags: - Signed - ProcessId - OriginalFileName - - Computer + - dest - EventCode - Company risk_score: 63 diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 2878d34994..f1900d02ea 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as - firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode + firstTime max(_time) as lastTime by Image ImageLoaded process_name dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -30,7 +30,7 @@ tags: confidence: 80 impact: 60 message: The following module $ImageLoaded$ was loaded by a non-standard application - on endpoint $Computer$ by user $user$. + on endpoint $dest$ by user $user$. mitre_attack_id: - T1218 - T1218.003 @@ -39,7 +39,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim @@ -56,7 +56,7 @@ tags: - Image - ImageLoaded - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 11de816407..6d562984e2 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -17,7 +17,7 @@ data_source: search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time) - as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode + as firstTime max(_time) as lastTime by Image ImageLoaded process_name dest EventCode Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbemprox_com_object_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -36,12 +36,12 @@ tags: asset_type: Endpoint confidence: 50 impact: 70 - message: Suspicious COM Object Execution on $Computer$ + message: Suspicious COM Object Execution on $dest$ mitre_attack_id: - T1218 - T1218.003 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -54,7 +54,7 @@ tags: - Image - ImageLoaded - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 9f14633af9..6ef04543b2 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -19,7 +19,7 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name - ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` + ProcessId QueryName QueryStatus QueryResults dest EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from @@ -56,7 +56,7 @@ tags: - QueryName - QueryStatus - QueryResults - - Computer + - dest - EventCode risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index ceb1eae9e5..0dc5d5feb3 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -14,7 +14,7 @@ data_source: search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId - GrantedAccess CallTrace Computer user_id | `security_content_ctime(firstTime)` | + GrantedAccess CallTrace dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model @@ -32,12 +32,12 @@ tags: confidence: 60 impact: 60 message: A process $SourceImage$ is duplicating the handle token of winlogon.exe - in $Computer$ + in $dest$ mitre_attack_id: - T1134.001 - T1134 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -59,7 +59,7 @@ tags: - TargetProcessId - GrantedAccess - CallTrace - - Computer + - dest - user_id risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index b3513f7bea..f6a982f5b0 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -36,12 +36,12 @@ tags: confidence: 70 impact: 70 message: a process $SourceImage$ is duplicating the handle token of winlogon.exe - in $Computer$ + in $dest$ mitre_attack_id: - T1134.001 - T1134 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -63,7 +63,7 @@ tags: - TargetProcessId - GrantedAccess - CallTrace - - Computer + - dest - user_id risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml index df67f7c8cf..da712fb072 100644 --- a/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_qakbot_namedpipe.yml @@ -18,7 +18,7 @@ search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPip "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe") | regex PipeName="^\\\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{8}" | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType - ProcessGuid ProcessId PipeName SecurityID EventCode Computer UserID | `security_content_ctime(firstTime)` + ProcessGuid ProcessId PipeName SecurityID EventCode dest UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_app_layer_protocol_qakbot_namedpipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, pipename, processguid and named pipe event type from @@ -35,11 +35,11 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: $Image$ is creating or connecting to a named pipe $PipeName$ in $Computer$ + message: $Image$ is creating or connecting to a named pipe $PipeName$ in $dest$ mitre_attack_id: - T1071 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -54,7 +54,7 @@ tags: - ProcessGuid - ProcessId - PipeName - - Computer + - dest - UserID - SecurityID risk_score: 49 diff --git a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml index a222cb278d..320c225175 100644 --- a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml @@ -15,7 +15,7 @@ description: The following analytic identifies a suspicious wermgr.exe process c data_source: [] search: '`sysmon` EventCode IN (17, 18) Image= "*\\wermgr.exe" EventType IN ( "CreatePipe", "ConnectPipe") | stats min(_time) as firstTime max(_time) as lastTime count by - Image EventType ProcessGuid ProcessId PipeName SecurityID EventCode Computer UserID + Image EventType ProcessGuid ProcessId PipeName SecurityID EventCode dest UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, pipename, processguid and named pipe event type from @@ -32,11 +32,11 @@ tags: confidence: 70 impact: 70 message: wermgr.exe process is creating or connecting to a named pipe $PipeName$ - in $Computer$ + in $dest$ mitre_attack_id: - T1071 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -51,7 +51,7 @@ tags: - ProcessGuid - ProcessId - PipeName - - Computer + - dest - UserID - SecurityID risk_score: 49 diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml index dbf44490dc..eddb9e083d 100644 --- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml +++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml @@ -17,7 +17,7 @@ data_source: [] search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType - ProcessId PipeName Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + ProcessId PipeName dest UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -38,7 +38,7 @@ tags: mitre_attack_id: - T1071 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -52,7 +52,7 @@ tags: - EventType - ProcessId - PipeName - - Computer + - dest - UserID risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml index f5b25908e0..f0b6b22080 100644 --- a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml +++ b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml @@ -17,7 +17,7 @@ data_source: - Sysmon Event ID 23 search: '`sysmon` EventCode=23 TargetFilename IN ("*.exe", "*.sys", "*.dll") | bin _time span=2m | stats values(TargetFilename) as deleted_files min(_time) as firstTime - max(_time) as lastTime count by Computer user EventCode Image ProcessID | where + max(_time) as lastTime count by dest user EventCode Image ProcessID | where count >=500 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_data_destruction_recursive_exec_files_deletion_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -34,7 +34,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: a big number of executable files being deleted in $Computer$ + message: a big number of executable files being deleted in $dest$ mitre_attack_id: - T1485 observable: @@ -42,7 +42,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -57,7 +57,7 @@ tags: required_fields: - EventCode - TargetFilename - - Computer + - dest - user - Image - ProcessID diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index 06fd02574f..d35179da9f 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -19,7 +19,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary - = True | rename Computer as dest process_name AS ImageLoaded process_path AS Module_Path + = True | rename dest as dest process_name AS ImageLoaded process_path AS Module_Path | stats values(parent_process_name) count by _time dest ImageLoaded Module_Path | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml index 3dd424fadc..548062f3fc 100644 --- a/detections/endpoint/windows_dll_side_loading_in_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml @@ -17,7 +17,7 @@ search: '`sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windo "*:\\windows\\sysWow64\\*")) AND NOT(ImageLoaded IN("*:\\windows\\system32\\*", "*:\\windows\\sysWow64\\*", "*:\\windows\\WinSXS\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product - process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` + process_name dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_side_loading_in_calc_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from @@ -34,12 +34,12 @@ tags: confidence: 100 impact: 90 message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common - windows OS installation folder in $Computer$ + windows OS installation folder in $dest$ mitre_attack_id: - T1574.002 - T1574 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -54,7 +54,7 @@ tags: - OriginalFileName - Product - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index 8c66603eb4..67b0127e44 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -14,7 +14,7 @@ description: The following analytic assists with viewing all drivers being loade data_source: - Sysmon Event ID 6 search: '`sysmon` EventCode=6 | stats min(_time) as firstTime max(_time) as lastTime - values(ImageLoaded) count by Computer Signed Signature service_signature_verified + values(ImageLoaded) count by dest Signed Signature service_signature_verified service_signature_exists Hashes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_drivers_loaded_by_signature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -37,12 +37,12 @@ tags: asset_type: Endpoint confidence: 70 impact: 60 - message: A driver has loaded on $Computer$. + message: A driver has loaded on $dest$. mitre_attack_id: - T1014 - T1068 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -53,7 +53,7 @@ tags: required_fields: - _time - ImageLoaded - - Computer + - dest - Signed - Signature - service_signature_verified diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml index 98c1610f1c..d27545a579 100644 --- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -16,7 +16,7 @@ data_source: search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\windows\\system32\\*","*\\windows\\SysWOW64\\*")) (DestinationPortName="ftp" OR DestinationPort=21) | stats count min(_time) as firstTime max(_time) as lastTime by Image DestinationPort DestinationPortName DestinationHostname - DestinationIp SourcePort SourcePortName Protocol SourceHostname Computer user | + DestinationIp SourcePort SourcePortName Protocol SourceHostname dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_transfer_protocol_in_non_common_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your @@ -33,12 +33,12 @@ tags: confidence: 30 impact: 30 message: a process $Image$ is having a FTP connection to $DestinationHostname$ in - $Computer$ + $dest$ mitre_attack_id: - T1071.003 - T1071 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -57,7 +57,7 @@ tags: - SourcePortName - Protocol - DestinationIp - - Computer + - dest - user risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml index 241e8715d0..834162364f 100644 --- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -16,7 +16,7 @@ search: '`sysmon` EventCode=7 (ImageLoaded = "*\\samlib.dll" AND OriginalFileNa = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL") AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name - Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_identity_sam_info_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to @@ -32,13 +32,13 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: An instance of $Computer$ that loads $ImageLoaded$ that are related to + message: An instance of $dest$ that loads $ImageLoaded$ that are related to accessing to SAM object information. mitre_attack_id: - T1589.001 - T1589 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -50,7 +50,7 @@ tags: - _time - Image - ImageLoaded - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml index 59f0b58ed7..ac64b23fce 100644 --- a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -15,7 +15,7 @@ search: '`sysmon` EventCode=22 QueryName IN ("*wtfismyip.com", "*checkip.amazon "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*") | stats min(_time) as firstTime max(_time) as lastTime count by Image ProcessId - QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` + QueryName QueryStatus QueryResults dest EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from @@ -32,12 +32,12 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: process connecting IP location web services on $Computer$ + message: process connecting IP location web services on $dest$ mitre_attack_id: - T1590.005 - T1590 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -52,7 +52,7 @@ tags: - QueryName - QueryStatus - QueryResults - - Computer + - dest - EventCode risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index dbfe3341c6..266d15d81d 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -15,7 +15,7 @@ search: '`sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.j "*.jpeg", "*.db", "*.ps1", "*.doc*", "*.xls*", "*.ppt*", "*.bmp","*.zip", "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf" , "*.backup*", "*.dsk", "*.win") | stats values(TargetFilename) as deleted_files - min(_time) as firstTime max(_time) as lastTime count by Computer user EventCode + min(_time) as firstTime max(_time) as lastTime count by dest user EventCode Image ProcessID |where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -37,7 +37,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 90 - message: High frequency file deletion activity detected on host $Computer$ + message: High frequency file deletion activity detected on host $dest$ mitre_attack_id: - T1485 observable: @@ -45,7 +45,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -60,7 +60,7 @@ tags: required_fields: - EventCode - TargetFilename - - Computer + - dest - user - Image - ProcessID diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml index 8e113b49b9..ce44eadcdd 100644 --- a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml +++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml @@ -17,7 +17,7 @@ data_source: search: '`sysmon` EventCode=7 ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*", "*\\windows\\syswow64\\*"))) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name - Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hijack_execution_flow_version_dll_side_load_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to @@ -31,12 +31,12 @@ tags: asset_type: Endpoint confidence: 70 impact: 50 - message: a process $Image$ loading $ImageLoaded$ as a side load dll in $Computer$ + message: a process $Image$ loading $ImageLoaded$ as a side load dll in $dest$ mitre_attack_id: - T1574.001 - T1574 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -49,7 +49,7 @@ tags: - Image - ImageLoaded - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml index 481a560733..f091b53db2 100644 --- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml @@ -13,8 +13,8 @@ description: The following hunting analytic identifies all processes requesting data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) as - firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, - SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)` + firstTime max(_time) as lastTime by dest, TargetImage, GrantedAccess, SourceImage, + SourceProcessId, SourceUser, TargetUser | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -55,7 +55,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - TargetImage - GrantedAccess - SourceImage diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index ab9dd4b28c..2b6bab1220 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -18,7 +18,7 @@ search: '`sysmon` EventCode=7 (ImageLoaded = "*\\credui.dll" AND OriginalFileNa = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime - by Image ImageLoaded OriginalFileName Computer EventCode Signed ProcessId ProcessGuid + by Image ImageLoaded OriginalFileName dest EventCode Signed ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_input_capture_using_credential_ui_dll_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to @@ -34,12 +34,12 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: a process $Image$ loaded $ImageLoaded$ in $Computer$ + message: a process $Image$ loaded $ImageLoaded$ in $dest$ mitre_attack_id: - T1056.002 - T1056 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -52,7 +52,7 @@ tags: - Image - ImageLoaded - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index f569a9fe81..681624422d 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -24,8 +24,8 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 parent_process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) - as lastTime by Computer, parent_process_name, ImageLoaded, OriginalFileName, ProcessId - | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + as lastTime by dest, parent_process_name, ImageLoaded, OriginalFileName, ProcessId + | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml index c67be6822c..df9702a4a9 100644 --- a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml @@ -17,7 +17,7 @@ search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\thunderbird. (DestinationPortName="smtp" OR DestinationPort=25 OR DestinationPort=587) | stats count min(_time) as firstTime max(_time) as lastTime by Image DestinationPort DestinationPortName DestinationHostname SourceHostname SourcePort SourcePortName Protocol DestinationIp - Computer user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mail_protocol_in_non_common_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your @@ -34,12 +34,12 @@ tags: confidence: 30 impact: 30 message: a process $Image$ is having a SMTP connection to $DestinationHostname$ - in $Computer$ + in $dest$ mitre_attack_id: - T1071.003 - T1071 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -58,7 +58,7 @@ tags: - SourcePortName - Protocol - DestinationIp - - Computer + - dest - user risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml index 86734f1975..390049a433 100644 --- a/detections/endpoint/windows_mark_of_the_web_bypass.yml +++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml @@ -12,7 +12,7 @@ description: The following analytic identifies a suspicious process that delete security restrictions within the Windows Operating System, particularly pertaining to files downloaded from the internet. An example of this scenario is demonstrated by Ave Maria RAT, which attempts to delete this data stream as a means to evade such restrictions. search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" - | stats min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID Computer | rename Computer as dest + | stats min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID dest | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mark_of_the_web_bypass_filter`' @@ -48,7 +48,7 @@ tags: required_fields: - EventCode - TargetFilename - - Computer + - dest - user - Image - ProcessID diff --git a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml index 98a560e9c4..80981f7090 100644 --- a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml +++ b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 22 search: '`sysmon` EventCode=22 QueryName IN ("*.torproject.org", "www.theonionrouter.com") | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName - QueryStatus ProcessId Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + QueryStatus ProcessId dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multi_hop_proxy_tor_website_query_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 22 dns query events from your @@ -31,12 +31,12 @@ tags: confidence: 50 impact: 50 message: a process $Image$ is having a dns query in a tor domain $QueryName$ in - $Computer$ + $dest$ mitre_attack_id: - T1071.003 - T1071 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -50,7 +50,7 @@ tags: - QueryName - QueryStatus - ProcessId - - Computer + - dest risk_score: 25 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 549be06155..1223ea2e79 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -13,8 +13,8 @@ description: The following analytic identifies non SYSTEM accounts requesting ac data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*") - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, - GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer + | stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage, + GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -63,7 +63,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - TargetImage - GrantedAccess - SourceImage diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index c7b6fce794..bacc77e638 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -29,9 +29,9 @@ search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe GrantedAccess IN ("0x010 "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK - SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, Computer, + SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, dest, SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser - | rename Computer as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | rename dest as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -85,7 +85,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - TargetImage - GrantedAccess - SourceImage diff --git a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml index 50fc3e97e4..81dfcd307a 100644 --- a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml @@ -19,7 +19,7 @@ search: '`sysmon` EventCode=8 SourceImage = "*\\wermgr.exe" TargetImage IN ("*\\ "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGuid SourceProcessId StartAddress StartFunction TargetProcessGuid TargetProcessId EventCode - Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_of_wermgr_to_known_browser_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints @@ -36,12 +36,12 @@ tags: confidence: 70 impact: 70 message: wermgr.exe process $SourceImage$ create a remote thread to a browser process - $TargetImage$ in host $Computer$ + $TargetImage$ in host $dest$ mitre_attack_id: - T1055.001 - T1055 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -60,7 +60,7 @@ tags: - TargetProcessGuid - TargetProcessId - EventCode - - Computer + - dest risk_score: 49 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index efa9733bc9..0281d9b417 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -18,7 +18,7 @@ search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", " "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe","*\\cmd.exe", "*\\powershell.exe") | stats count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId SourceProcessId EventCode - StartAddress SourceImage Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + StartAddress SourceImage dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_remote_thread_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of @@ -37,12 +37,12 @@ tags: confidence: 80 impact: 80 message: process $SourceImage$ create a remote thread to process $TargetImage$ on - host $Computer$ + host $dest$ mitre_attack_id: - T1055 - T1055.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -66,7 +66,7 @@ tags: - SourceProcessId - StartAddress - EventCode - - Computer + - dest - signature - TargetProcessGuid - SourceProcessGuid diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index 349dbb88d9..3644dffd47 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -14,7 +14,7 @@ data_source: search: '`sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid - TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` + TargetProcessId SourceProcessId StartAddress EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_with_public_source_path_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model @@ -31,12 +31,12 @@ tags: confidence: 80 impact: 80 message: process $SourceImage$ create a remote thread to process $TargetImage$ on - host $Computer$ + host $dest$ mitre_attack_id: - T1055 - T1055.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -60,7 +60,7 @@ tags: - SourceProcessId - StartAddress - EventCode - - Computer + - dest - signature - TargetProcessGuid - SourceProcessGuid diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 6e41f44515..3f4d2d9152 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 9 search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as - lastTime by Image Device ProcessGuid ProcessId EventDescription EventCode Computer + lastTime by Image Device ProcessGuid ProcessId EventDescription EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and @@ -51,7 +51,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - Image - Device - ProcessGuid diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index e9ddffbcac..f7f4edb1d9 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 9 search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as - lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode + lastTime by dest Image Device ProcessGuid ProcessId EventDescription EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and @@ -44,7 +44,7 @@ tags: - T1561.002 - T1561 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -54,7 +54,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - Image - Device - ProcessGuid diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml index fb8ba84a69..f28d4ce760 100644 --- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml +++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml @@ -27,7 +27,7 @@ search: '`sysmon` EventCode=7 |bin _time span=30s | eval BRC4_AnomalyLoadedDll=c "dbghelp.dll"), 1, match(ImageLoaded, "samcli.dll"), 1, match(ImageLoaded, "winhttp.dll"), 1, 1=1, 0) | stats count min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as ImageLoaded values(OriginalFileName) as OriginalFileName dc(ImageLoaded) as ImageLoadedCount - by Image BRC4_LoadedDllPath BRC4_AnomalyLoadedDll Computer EventCode Signed | where ImageLoadedCount + by Image BRC4_LoadedDllPath BRC4_AnomalyLoadedDll dest EventCode Signed | where ImageLoadedCount == 4 AND (BRC4_LoadedDllPath == 1 OR BRC4_AnomalyLoadedDll == 1) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_brc4_loaded_dll_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 @@ -50,12 +50,12 @@ tags: confidence: 30 impact: 30 message: a process $Image$ loaded several modules $ImageLoaded$ that might related - to credential access on $Computer$. + to credential access on $dest$. mitre_attack_id: - T1219 - T1003 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -68,7 +68,7 @@ tags: - Image - ImageLoaded - process_name - - Computer + - dest - EventCode - Signed - ProcessId diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml index 59da0c519d..52fce34fe3 100644 --- a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml +++ b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml @@ -17,7 +17,7 @@ search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\pow "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe", "*\\msaccess.exe") AND NOT(QueryName IN ("*.office.com", "*.office.net")) | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus - Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -36,12 +36,12 @@ tags: confidence: 30 impact: 30 message: a office document process $Image$ connect to an URL link $QueryName$ in - $Computer$ + $dest$ mitre_attack_id: - T1566.001 - T1566 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim @@ -55,7 +55,7 @@ tags: - QueryName - QueryResults - QueryStatus - - Computer + - dest risk_score: 9 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml index e99c7b73d0..a9b9ff3555 100644 --- a/detections/endpoint/windows_terminating_lsass_process.yml +++ b/detections/endpoint/windows_terminating_lsass_process.yml @@ -19,7 +19,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage, TargetImage, - TargetProcessId, SourceProcessId, GrantedAccess CallTrace, Computer | rename Computer + TargetProcessId, SourceProcessId, GrantedAccess CallTrace, dest | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_terminating_lsass_process_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which @@ -60,7 +60,7 @@ tags: - EventCode - TargetImage - CallTrace - - Computer + - dest - TargetProcessId - SourceImage - SourceProcessId diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 25159dabc3..a93eb6149d 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -17,7 +17,7 @@ description: This analysis focuses on detecting potentially malicious unsigned D Detecting such suspicious DLLs is crucial in preventing privilege escalation attacks and other potential security breaches. Regular security assessments, thorough monitoring, and implementing security best practices are essential in safeguarding systems from such threats. search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH | rename Computer as dest + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name dest EventCode ProcessId Hashes IMPHASH | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`' @@ -54,7 +54,7 @@ tags: - SignatureStatus - OriginalFileName - process_name - - Computer + - dest - EventCode - ProcessId - Hashes diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml index 5afcd45676..49b35b7799 100644 --- a/detections/endpoint/windows_vulnerable_3cx_software.yml +++ b/detections/endpoint/windows_vulnerable_3cx_software.yml @@ -9,7 +9,7 @@ data_source: - Sysmon Event Code 1 description: The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app. search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe) FileVersion=18.12.* - | rename Computer as dest + | rename dest as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_vulnerable_3cx_software_filter`' @@ -54,7 +54,7 @@ tags: - process_name - EventID - CommandLine - - Computer + - dest - parent_process_name risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 18908f2f7c..a2b790ac2c 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -15,7 +15,7 @@ data_source: search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId - GrantedAccess CallTrace Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + GrantedAccess CallTrace dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_impersonate_token_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly @@ -39,7 +39,7 @@ tags: mitre_attack_id: - T1047 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -57,7 +57,7 @@ tags: - TargetProcessId - GrantedAccess - CallTrace - - Computer + - dest risk_score: 25 security_domain: endpoint tests: diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 197b348a0b..69ef6095eb 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -11,7 +11,7 @@ description: This analytic identifies XMRIG coinminer driver installation on the data_source: - Sysmon Event ID 6 search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" - | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded + | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xmrig_driver_loaded_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -27,12 +27,12 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ + message: A driver $ImageLoaded$ related to xmrig crytominer loaded in host $dest$ mitre_attack_id: - T1543.003 - T1543 observable: - - name: Computer + - name: dest type: Hostname role: - Victim @@ -42,7 +42,7 @@ tags: - Splunk Cloud required_fields: - _time - - Computer + - dest - ImageLoaded - Hashes - IMPHASH From 50d19ab56dd78253f6992a749a656f36e0ed8b18 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Sep 2023 15:26:01 -0700 Subject: [PATCH 24/89] updating moar --- change.py | 3 +++ detections/deprecated/detect_mimikatz_using_loaded_images.yml | 3 +-- detections/deprecated/unsigned_image_loaded_by_lsass.yml | 2 +- detections/endpoint/access_lsass_memory_for_dump_creation.yml | 2 +- detections/endpoint/create_remote_thread_into_lsass.yml | 3 +-- detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml | 2 +- .../detect_credential_dumping_through_lsass_access.yml | 3 +-- detections/endpoint/detect_regasm_with_network_connection.yml | 2 +- detections/endpoint/detect_regsvcs_with_network_connection.yml | 2 +- detections/endpoint/mshtml_module_load_in_office_product.yml | 2 +- .../rubeus_kerberos_ticket_exports_through_winlogon_access.yml | 2 +- .../windows_dll_search_order_hijacking_hunt_with_sysmon.yml | 2 +- .../windows_hunting_system_account_targeting_lsass.yml | 2 +- detections/endpoint/windows_installutil_credential_theft.yml | 2 +- detections/endpoint/windows_mark_of_the_web_bypass.yml | 2 +- detections/endpoint/windows_possible_credential_dumping.yml | 2 +- detections/endpoint/windows_unsigned_dll_side_loading.yml | 2 +- detections/endpoint/windows_vulnerable_3cx_software.yml | 2 +- 18 files changed, 20 insertions(+), 20 deletions(-) diff --git a/change.py b/change.py index dfd51827b7..99f9cdbe79 100644 --- a/change.py +++ b/change.py @@ -20,11 +20,14 @@ for dirpath, dirnames, filenames in os.walk(directory_path): pattern1 = r'\bComputer\b' pattern2 = r'$Computer\$' + pattern3 = r'\| rename dest as dest' r1 = 'dest' r2 = '$dest$' + r3 = '' content = re.sub(pattern1, r1, content) content = re.sub(pattern2, r2, content) + content = re.sub(pattern3, r3, content) # # Add `| windows_rename_to_cim` before `| stats` # content = content.replace('Computer ', 'dest') diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/detections/deprecated/detect_mimikatz_using_loaded_images.yml index 4efe0407e3..2ffe7ae919 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/detections/deprecated/detect_mimikatz_using_loaded_images.yml @@ -12,8 +12,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId) as ProcessId by dest, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll - ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename - dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mimikatz_using_loaded_images_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/detections/deprecated/unsigned_image_loaded_by_lsass.yml index c575f8f769..9651f6f1c8 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/detections/deprecated/unsigned_image_loaded_by_lsass.yml @@ -11,7 +11,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time) as firstTime max(_time) as lastTime by dest, Image, ImageLoaded, Signed, SHA1 - | rename dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `unsigned_image_loaded_by_lsass_filter` ' how_to_implement: This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`. diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index d7706eee51..ddd92bf6a8 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -10,7 +10,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage, - TargetProcessId, SourceImage, SourceProcessId | rename dest as dest | `security_content_ctime(firstTime)`| + TargetProcessId, SourceImage, SourceProcessId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` ' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index d04a766ac1..c6cfcfe66d 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -9,8 +9,7 @@ description: The following analytic developed to detect potential credential dum data_source: - Sysmon Event ID 8 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime - max(_time) as lastTime by dest, EventCode, TargetImage, TargetProcessId | rename - dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + max(_time) as lastTime by dest, EventCode, TargetImage, TargetProcessId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter`' how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index af9a53d857..228bcfc831 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp | stats count min(_time) as firstTime max(_time) as lastTime by dest, object_category, - process_name, TargetFilename | rename dest as dest | `security_content_ctime(firstTime)` + process_name, TargetFilename | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 1664a3f30c..32b9f4cdf3 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -11,8 +11,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) | stats count min(_time) as firstTime max(_time) as lastTime by dest, SourceImage, - SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename - dest as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_credential_dumping_through_lsass_access_filter` ' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index c8cdb3b357..b681e2fe61 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -18,7 +18,7 @@ description: The following analytic identifies regasm.exe with a network connect data_source: - Sysmon Event ID 3 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 - process_name=regasm.exe | rename dest as dest | stats count min(_time) as firstTime + process_name=regasm.exe | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index bd72db0e00..4bd8dc8242 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -18,7 +18,7 @@ description: The following analytic identifies Regsvcs.exe with a network connec data_source: - Sysmon Event ID 3 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 - process_name=regsvcs.exe | rename dest as dest | stats count min(_time) as firstTime + process_name=regsvcs.exe | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 3cb3073e3b..9583ef9bec 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -15,7 +15,7 @@ data_source: search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", "msaccess.exe","Graph.exe","winproj.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name, - ImageLoaded, OriginalFileName, ProcessGuid | rename dest as dest | `security_content_ctime(firstTime)` + ImageLoaded, OriginalFileName, ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index ab8fe06257..114c116a6d 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -22,7 +22,7 @@ search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time) as firstTime max(_time) as lastTime by dest, SourceImage, SourceProcessId, TargetImage, - TargetProcessId, EventCode, GrantedAccess | rename dest as dest | `security_content_ctime(firstTime)`| + TargetProcessId, EventCode, GrantedAccess | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index d35179da9f..41e3ce8839 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -19,7 +19,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary - = True | rename dest as dest process_name AS ImageLoaded process_path AS Module_Path + = True process_name AS ImageLoaded process_path AS Module_Path | stats values(parent_process_name) count by _time dest ImageLoaded Module_Path | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml index f091b53db2..951099e161 100644 --- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage, GrantedAccess, SourceImage, - SourceProcessId, SourceUser, TargetUser | rename dest as dest | `security_content_ctime(firstTime)` + SourceProcessId, SourceUser, TargetUser | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 681624422d..777787fcf4 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -25,7 +25,7 @@ data_source: search: '`sysmon` EventCode=7 parent_process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, ImageLoaded, OriginalFileName, ProcessId - | rename dest as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml index 390049a433..7cda12494f 100644 --- a/detections/endpoint/windows_mark_of_the_web_bypass.yml +++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml @@ -12,7 +12,7 @@ description: The following analytic identifies a suspicious process that delete security restrictions within the Windows Operating System, particularly pertaining to files downloaded from the internet. An example of this scenario is demonstrated by Ave Maria RAT, which attempts to delete this data stream as a means to evade such restrictions. search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" - | stats min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID dest | rename dest as dest + | stats min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mark_of_the_web_bypass_filter`' diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index bacc77e638..633649e300 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -31,7 +31,7 @@ search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe GrantedAccess IN ("0x010 "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, dest, SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser - | rename dest as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index a93eb6149d..faa2cef19a 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -17,7 +17,7 @@ description: This analysis focuses on detecting potentially malicious unsigned D Detecting such suspicious DLLs is crucial in preventing privilege escalation attacks and other potential security breaches. Regular security assessments, thorough monitoring, and implementing security best practices are essential in safeguarding systems from such threats. search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name dest EventCode ProcessId Hashes IMPHASH | rename dest as dest + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name dest EventCode ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`' diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml index 49b35b7799..e749b51a87 100644 --- a/detections/endpoint/windows_vulnerable_3cx_software.yml +++ b/detections/endpoint/windows_vulnerable_3cx_software.yml @@ -9,7 +9,7 @@ data_source: - Sysmon Event Code 1 description: The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app. search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe) FileVersion=18.12.* - | rename dest as dest + | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_vulnerable_3cx_software_filter`' From 9638d6de537b5886736c30ee28c712fd3333f693 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Sep 2023 15:27:12 -0700 Subject: [PATCH 25/89] remove wrong file --- change.py | 53 ----------------------------------------------------- 1 file changed, 53 deletions(-) delete mode 100644 change.py diff --git a/change.py b/change.py deleted file mode 100644 index 99f9cdbe79..0000000000 --- a/change.py +++ /dev/null @@ -1,53 +0,0 @@ -import os -import re - -# Directory containing YAML files -directory_path = "/Users/bpatel/Research/malware/splunk_github/security_content/detections" - -# Iterate through each file in the directory and its subdirectories -for dirpath, dirnames, filenames in os.walk(directory_path): - for filename in filenames: - if filename.endswith('.yml'): - filepath = os.path.join(dirpath, filename) - - # Open and read the YAML file as text - with open(filepath, 'r') as f: - content = f.read() - - # Check if the data source contains "Powershell 4104" - if "`sysmon`" in content: - # print(type(content)) - - pattern1 = r'\bComputer\b' - pattern2 = r'$Computer\$' - pattern3 = r'\| rename dest as dest' - r1 = 'dest' - r2 = '$dest$' - r3 = '' - - content = re.sub(pattern1, r1, content) - content = re.sub(pattern2, r2, content) - content = re.sub(pattern3, r3, content) - - # # Add `| windows_rename_to_cim` before `| stats` - # content = content.replace('Computer ', 'dest') - # content = content.replace('$Computer$', '$dest$') - # content = content.replace('$Computer$', '$dest$') - - # # In the `| stats` command, rename Computer to dest and UserID to user - # content = content.replace('by EventCode ScriptBlockText Computer UserID', - # 'by EventCode ScriptBlockText dest user') - - # # Update the observable section - # content = content.replace('name: Computer', 'name: dest') - # content = content.replace('name: UserID', 'name: user') - - # # Update the required_fields section - # content = content.replace('- Computer\n', '- dest\n') - # content = content.replace('- UserID\n', '- user\n') - - # Write the modified content back to the YAML file - with open(filepath, 'w') as f: - f.write(content) - -print("Finished updating YAML files.") \ No newline at end of file From b755851d40b69b18a7ee1cc44303b7a685bc5dc7 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 19 Sep 2023 15:57:43 -0700 Subject: [PATCH 26/89] updates for failued searches --- detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml | 2 +- .../suspicious_process_dns_query_known_abuse_web_services.yml | 2 +- .../endpoint/suspicious_process_with_discord_dns_query.yml | 2 +- .../wermgr_process_connecting_to_ip_check_web_services.yml | 2 +- ...ther_victim_network_info_through_ip_check_web_services.yml | 4 ++-- .../endpoint/windows_multi_hop_proxy_tor_website_query.yml | 2 +- ...arphishing_attachment_connect_to_none_ms_office_domain.yml | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index be8bcb32bc..422d1da8a8 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -13,7 +13,7 @@ data_source: search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime - by dest Image ImageLoaded process_name dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` + by dest Image ImageLoaded process_name EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 65e9104488..380824a0c5 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -17,7 +17,7 @@ data_source: search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image - QueryName QueryStatus process_name QueryResults dest | `security_content_ctime(firstTime)` + QueryName QueryStatus process_name QueryResults Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 5d9406c690..e84f359f30 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -15,7 +15,7 @@ data_source: search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name - QueryResults dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + QueryResults Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`' how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query. known_false_positives: Noise and false positive can be seen if the following instant diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 6ef04543b2..556aa92ec9 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -19,7 +19,7 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name - ProcessId QueryName QueryStatus QueryResults dest EventCode | `security_content_ctime(firstTime)` + ProcessId QueryName QueryStatus QueryResults EventCode Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from diff --git a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml index ac64b23fce..d91b6070eb 100644 --- a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -15,7 +15,7 @@ search: '`sysmon` EventCode=22 QueryName IN ("*wtfismyip.com", "*checkip.amazon "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*") | stats min(_time) as firstTime max(_time) as lastTime count by Image ProcessId - QueryName QueryStatus QueryResults dest EventCode | `security_content_ctime(firstTime)` + QueryName QueryStatus QueryResults EventCode Computer | rename Computer as dest| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from @@ -32,7 +32,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: process connecting IP location web services on $dest$ + message: Process connecting IP location web services on $dest$ mitre_attack_id: - T1590.005 - T1590 diff --git a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml index 80981f7090..00177881e9 100644 --- a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml +++ b/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 22 search: '`sysmon` EventCode=22 QueryName IN ("*.torproject.org", "www.theonionrouter.com") | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName - QueryStatus ProcessId dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + QueryStatus ProcessId Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multi_hop_proxy_tor_website_query_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 22 dns query events from your diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml index 52fce34fe3..0c7d7ca73b 100644 --- a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml +++ b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml @@ -17,7 +17,7 @@ search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\pow "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe", "*\\msaccess.exe") AND NOT(QueryName IN ("*.office.com", "*.office.net")) | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your From 76ee731e877f1f040fbc6a4278fde9a0f5edf36c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 20 Sep 2023 12:06:59 -0600 Subject: [PATCH 27/89] Update juniper_networks_remote_code_execution_exploit_detection.yml --- .../juniper_networks_remote_code_execution_exploit_detection.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml index 36fded196d..b2d23e1275 100644 --- a/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml +++ b/detections/web/juniper_networks_remote_code_execution_exploit_detection.yml @@ -21,6 +21,7 @@ references: - https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html - https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844 - https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/ +- https://vulncheck.com/blog/juniper-cve-2023-36845 tags: analytic_story: - Juniper JunOS Remote Code Execution From 82b699b444a42aa55a3ba8ba062746adde119bf1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 20 Sep 2023 11:55:18 -0700 Subject: [PATCH 28/89] updating tor detection --- detections/network/tor_traffic.yml | 44 ++++++++++++++++-------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/detections/network/tor_traffic.yml b/detections/network/tor_traffic.yml index 8445c8aa63..ee6a4c7b82 100644 --- a/detections/network/tor_traffic.yml +++ b/detections/network/tor_traffic.yml @@ -1,26 +1,22 @@ name: TOR Traffic id: ea688274-9c06-4473-b951-e4cb7a5d7a45 -version: 2 -date: '2020-07-22' -author: David Dorsey, Splunk -status: experimental +version: 3 +date: '2023-09-20' +author: David Dorsey, Bhavin Patel, Splunk +status: production type: TTP -description: This search looks for network traffic identified as The Onion Router - (TOR), a benign anonymity network which can be abused for a variety of nefarious - purposes. +description: The following analytic looks for allowed network traffic to The Onion Router(TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. Detecting Tor traffic is paramount for upholding network security and mitigating potential threats. Tor's capacity to provide users with anonymity has been exploited by cybercriminals for activities like hacking, data breaches, and illicit content dissemination. Additionally, organizations must monitor Tor usage within their networks to ensure compliance with policies and regulations, as it can bypass conventional monitoring and filtering measures. Lastly, the ability to identify Tor traffic empowers security teams to promptly investigate and address potential security incidents, fortifying the protection of sensitive data and preserving the integrity of the network environment. data_source: [] search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `tor_traffic_filter`' -how_to_implement: In order to properly run this search, Splunk needs to ingest data - from firewalls or other network control devices that mediate the traffic allowed - into an environment. This is necessary so that the search can identify an 'action' - taken on the traffic of interest. The search requires the Network_Traffic data model - be populated. +how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model to be populated. known_false_positives: None at this time -references: [] +references: + - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRtCAK + - https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/#:~:text=For%20enterprises%20concerned%20about%20the,the%20most%20important%20security%20risks. tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch @@ -28,15 +24,15 @@ tags: - NOBELIUM Group - Command And Control asset_type: Endpoint - confidence: 50 - impact: 50 - message: tbd + confidence: 80 + impact: 100 + message: Suspicious network traffic allowed using TOR has been detected from $src_ip$ to $dest_ip$ mitre_attack_id: - - T1071 - - T1071.001 + - T1090 + - T1090.003 observable: - - name: dest - type: Hostname + - name: src_ip + type: IP Address role: - Victim product: @@ -50,5 +46,11 @@ tags: - All_Traffic.src_ip - All_Traffic.dest_ip - All_Traffic.dest_port - risk_score: 25 + risk_score: 80 security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log + source: pan_tor_allowed + sourcetype: pan:traffic From c09b037509fcdf534859eb5b24882b8212254c47 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 20 Sep 2023 15:45:48 -0700 Subject: [PATCH 29/89] fixes --- detections/endpoint/rundll32_dnsquery.yml | 2 +- .../windows_dll_search_order_hijacking_hunt_with_sysmon.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index 30cd59cd5a..f415b629d7 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -13,7 +13,7 @@ description: This search is to detect a suspicious rundll32.exe process having a data_source: - Sysmon Event ID 22 search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) - as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId dest + as firstTime max(_time) as lastTime values(query) as query values(answer) as answer values(QueryResults) as query_results values(QueryStatus) as query_status by process_name process_guid Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index 41e3ce8839..07f9d7117a 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -19,7 +19,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS process_name OUTPUT islibrary | search islibrary - = True process_name AS ImageLoaded process_path AS Module_Path + = True |rename process_name AS ImageLoaded process_path AS Module_Path | stats values(parent_process_name) count by _time dest ImageLoaded Module_Path | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 From 71e6ae840674361ef487e33f0c6016bba20e8a67 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 21 Sep 2023 10:56:06 +0200 Subject: [PATCH 30/89] njrat2 --- detections/endpoint/disable_registry_tool.yml | 1 + .../endpoint/disabling_cmd_application.yml | 1 + .../disabling_systemrestore_in_registry.yml | 1 + .../endpoint/disabling_task_manager.yml | 1 + .../endpoint/windows_abused_web_services.yml | 67 +++++++++++++++++ .../windows_admin_permission_discovery.yml | 74 +++++++++++++++++++ 6 files changed, 145 insertions(+) create mode 100644 detections/endpoint/windows_abused_web_services.yml create mode 100644 detections/endpoint/windows_admin_permission_discovery.yml diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 92db5125fe..64d5484233 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 100 impact: 40 diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 817240a760..f76ee91f89 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 82c83ff3ff..c54d46907b 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index f1fca5a4c6..19e51f98d7 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse + - NjRAT asset_type: Endpoint confidence: 60 impact: 70 diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/endpoint/windows_abused_web_services.yml new file mode 100644 index 0000000000..e3578a6827 --- /dev/null +++ b/detections/endpoint/windows_abused_web_services.yml @@ -0,0 +1,67 @@ +name: Windows Abused Web Services +id: 01f0aef4-8591-4daa-a53d-0ed49823b681 +version: 1 +date: '2023-09-20' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 22 +description: This analytic detects a suspicious process making a DNS query via known, + abused text-paste web services, VoIP, internet via secure tunneling,instant messaging, and digital distribution + platforms used to download external files. This technique is abused by adversaries, + malware actors, and red teams to download a malicious file on the target host. This + is a good TTP indicator for possible initial access techniques. A user will experience + false positives if the following instant messaging is allowed or common applications + like telegram or discord are allowed in the corporate network. +search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*",""*textbin*"", "*ngrok.io*", "*discord*", "*duckdns.org*", "*pasteio.com*") + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_abused_web_services_filter`' +how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. + We suggest you run this detection at least once a day over the last 14 days. +known_false_positives: Noise and false positive can be seen if the following instant + messaging is allowed to use within corporate network. In this case, a filter is + needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a network connection on known abused web services from $dest$ + mitre_attack_id: + - T1102 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - process_name + - QueryResults + - Computer + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml new file mode 100644 index 0000000000..0a9e36204a --- /dev/null +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -0,0 +1,74 @@ +name: Windows Admin Permission Discovery +id: e08620cb-9488-4052-832d-97bcc0afd414 +version: 1 +date: '2023-09-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 11 +description: This analytic is developed to identify suspicious file creation in the root drive (C:\). + This tactic was observed in NjRAT as a means to ascertain whether its malware instance running on + the compromised host possesses administrative privileges. + The methodology involves an attempt to create a 'win.dat' file in the C:\ directory. + If this file is successfully created, it serves as an indicator that the process indeed holds administrative privileges. + This anomaly detection mechanism serves as a valuable pivot point for detecting NjRAT and other malware strains employing + similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") + | eval dropped_file_path_split_count = mvcount(dropped_file_path) + | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_admin_permission_discovery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that + include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: administrator is capable of dropping files in root C drive. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a file was created in root drive c in $dest$ + mitre_attack_id: + - T1069.001 + observable: + - name: user + type: User + role: + - Victim + - name: process_id + type: Process + role: + - Attacker + - name: file_name + type: File Name + role: + - Other + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 25 + required_fields: + - _time + - Filesystem.file_path + - Filesystem.file_create_time + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.user + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From b84752b863ed4c7d97359dff79be1bb5dbbc8f4f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 21 Sep 2023 14:00:46 -0700 Subject: [PATCH 31/89] conflicts --- .../endpoint/uac_bypass_with_colorui_com_object.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index f67a0f1795..f0eaf1cd60 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -12,8 +12,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as - firstTime max(_time) as lastTime by Image ImageLoaded process_name dest user EventCode - Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + firstTime max(_time) as lastTime by Image ImageLoaded process_name dest user_id EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -29,16 +28,11 @@ tags: asset_type: Endpoint confidence: 80 impact: 60 - message: The following module $ImageLoaded$ was loaded by a non-standard application - on endpoint $dest$ by user $user$. + message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $dest$. mitre_attack_id: - T1218 - T1218.003 observable: - - name: user - type: User - role: - - Victim - name: dest type: Hostname role: From 9332e6a24cd2e4fe81d891561a1e9d6e7953684f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 22 Sep 2023 15:01:21 -0700 Subject: [PATCH 32/89] o365_obs_fix --- .../application/okta_risk_threshold_exceeded.yml | 14 +++----------- ...unk_csrf_in_the_ssg_kvstore_client_endpoint.yml | 4 ++-- .../cloud/aws_excessive_security_scanning.yml | 8 +++----- ...ss_control_list_created_with_all_open_ports.yml | 14 ++++---------- detections/cloud/aws_setdefaultpolicyversion.yml | 2 +- detections/cloud/aws_updateloginprofile.yml | 2 +- ...ioning_activity_from_previously_unseen_city.yml | 4 ++-- ...tiple_users_failing_to_authenticate_from_ip.yml | 3 +-- ...al_number_of_failed_authentications_from_ip.yml | 2 +- .../o365_add_app_role_assignment_grant_user.yml | 9 ++++----- detections/cloud/o365_disable_mfa.yml | 3 +-- .../cloud/o365_excessive_sso_logon_errors.yml | 8 +++----- 12 files changed, 26 insertions(+), 47 deletions(-) diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index b876009bad..25aaf112a1 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -8,9 +8,7 @@ type: Correlation description: The following correlation will take risk associated with the content from "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories and - tally it up. Once it hits the threshold of 100 (may be changed), it will trigger - an anomaly. As needed, reduce or raise the risk scores assocaited with the anomaly - and TTP analytics tagged to these two stories. + tally it up. Once it hits the threshold of 100 (can be changed), it will trigger an a notable. As needed, reduce or raise the risk scores assocaited with the anomaly and TTP analytics tagged to these two analytic stories. data_source: [] search: '| tstats `security_content_summariesonly` sum(All_Risk.calculated_risk_score) as risk_score, @@ -44,19 +42,13 @@ tags: asset_type: Infrastructure confidence: 80 impact: 70 - message: - Risk threshold exceeded for $risk_object_type$=$risk_object$ related to - Okta events. + message: Risk score $risk_score$ threshold exceeded for $risk_object$ related to Okta events. mitre_attack_id: - T1078 - T1110 observable: - name: risk_object - type: Other - role: - - Victim - - name: risk_object_type - type: Other + type: Hostname role: - Victim product: diff --git a/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml b/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml index 71ace02eea..b223e068ec 100644 --- a/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml +++ b/detections/application/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml @@ -14,7 +14,7 @@ description: In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cr this vulnerability. data_source: [] search: '`splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET" - delete_field_value="spacebridge_server" status="200" | table splunk_server status + delete_field_value="spacebridge_server" status="200" | table splunk_server status uri delete_field_value method post_data | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`' how_to_implement: Requires access to internal index. known_false_positives: This hunting search only applies to the affected versions and @@ -31,7 +31,7 @@ tags: cve: - CVE-2023-22942 impact: 50 - message: Potential CSRF exploitation attempt from $host$ + message: Potential CSRF exploitation attempt from $splunk_server$ mitre_attack_id: - T1189 observable: diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index d1999abac3..f96acc5ba0 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events and analyse the amount data_source: [] search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime - values(eventName) as eventName values(src) as src values(userAgent) as userAgent + values(eventName) as command values(src) as src values(userAgent) as userAgent by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This @@ -25,9 +25,7 @@ tags: asset_type: AWS Account confidence: 60 impact: 30 - message: user $user$ has excessive number of api calls $dc_events$ from these IP - addresses $src$, violating the threshold of 50, using the following commands - $command$. + message: User $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$. mitre_attack_id: - T1526 observable: @@ -38,7 +36,7 @@ tags: - name: user type: User role: - - Attacker + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index 0f041aec08..bb0f5c051c 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -5,8 +5,7 @@ date: '2021-01-11' author: Bhavin Patel, Patrick Bareiss, Splunk status: production type: TTP -description: The search looks for AWS CloudTrail events to detect if any network ACLs - were created with all the ports open to a specified CIDR. +description: The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. data_source: [] search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 @@ -14,7 +13,7 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 | eval port_range=''requestParameters.portRange.to'' - ''requestParameters.portRange.from'' | where port_range>1024] | fillnull | stats count min(_time) as firstTime max(_time) - as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction + as lastTime by userName user_arn userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`' @@ -31,8 +30,7 @@ tags: asset_type: AWS Instance confidence: 80 impact: 60 - message: User $user_arn$ has created network ACLs with all the ports open to a specified - CIDR $requestParameters.cidrBlock$ + message: User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ mitre_attack_id: - T1562.007 - T1562 @@ -41,14 +39,10 @@ tags: type: IP Address role: - Attacker - - name: userName + - name: user_arn type: User role: - Victim - - name: requestParameters.cidrBlock - type: IP Address - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index fb1a37ef96..7d84994f1a 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -30,7 +30,7 @@ tags: asset_type: AWS Account confidence: 60 impact: 50 - message: From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an + message: From IP address $src$, user $user_arn$ has trigged an event $eventName$ for updating the the default policy version mitre_attack_id: - T1078.004 diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index 806ad3893f..31a0cb1a29 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -29,7 +29,7 @@ tags: asset_type: AWS Account confidence: 60 impact: 50 - message: From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an + message: From IP address $src$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges mitre_attack_id: diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index ecfe277fb4..626e844cc3 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -46,7 +46,7 @@ tags: asset_type: AWS Instance confidence: 60 impact: 30 - message: User $user$ is starting or creating an instance $dest$ for the first time + message: User $user$ is starting or creating an instance $object$ for the first time in City $City$ from IP address $src$ mitre_attack_id: - T1078 @@ -54,7 +54,7 @@ tags: - name: user type: User role: - - Attacker + - Victim - name: src type: IP Address role: diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml index 740f6c5ece..5670f96f0a 100644 --- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml @@ -36,8 +36,7 @@ tags: asset_type: Google Cloud Platform tenant confidence: 90 impact: 60 - message: Multiple failed login attempts against users $tried_accounts$ seen from - $src_ip$ + message: Multiple failed login attempts against users $tried_accounts$ seen from $src$ mitre_attack_id: - T1586 - T1586.003 diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml index 142571201b..df4609147b 100644 --- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml @@ -44,7 +44,7 @@ tags: confidence: 90 impact: 60 message: Unusual number of failed console login attempts against users $tried_accounts$ - seen from $src_ip$ + seen from $src$ mitre_attack_id: - T1586 - T1586.003 diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index a2024a7d5e..fd9206dd2c 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -11,7 +11,7 @@ description: This search is designed to detect the creation of a new Federation providing an additional layer of security for your environment. data_source: [] search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." - | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by UserId dest ResultStatus + | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type values(ModifiedProperties{}.Name) as modified_properties_name by user dest ResultStatus Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' @@ -30,16 +30,15 @@ tags: asset_type: Office 365 confidence: 60 impact: 30 - message: User $Actor.ID$ has created a new federation setting on $dest$ from IP - Address $ActorIpAddress$ + message: User $Actor.ID$ has created a new federation setting $modified_properties_name$ on $dest$ mitre_attack_id: - T1136.003 - T1136 observable: - - name: UserId + - name: user type: User role: - - Attacker + - Victim - name: dest type: Endpoint role: diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index c01ae46697..72c712d7b2 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -25,8 +25,7 @@ tags: asset_type: Office 365 confidence: 80 impact: 80 - message: User $user$ has executed an operation $Operation$ for this destination - $dest$ + message: User $src_user$ has executed an operation $action$ for user $user$ mitre_attack_id: - T1556 observable: diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 2df173c3d7..d31bcd99a4 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -6,10 +6,9 @@ author: Rod Soto, Splunk status: production type: Anomaly description: The following analytic detects accounts with high number of Single Sign ON (SSO) - logon errors. Excessive logon errors may indicate attempts to bruteforce of password - or single sign on token hijack or reuse. + logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. data_source: [] -search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed | stats count min(_time) as firstTime max(_time) as lastTime by user src_ip LogonError user_agent UserId Operation Workload authentication_method authentication_service| where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip signature user_agent authentication_service action| where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: Logon errors may not be malicious in nature however it may @@ -23,8 +22,7 @@ tags: asset_type: Office 365 confidence: 80 impact: 80 - message: User $user$ has caused excessive number of SSO logon errors from $src_ip$ - using UserAgent $UserAgent$. + message: Excessive number of SSO logon errors from $src_ip$ using UserAgent $user_agent$. mitre_attack_id: - T1556 observable: From 7cead8e9566816fb02929eab1d1e8308c5543dd5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 22 Sep 2023 15:47:54 -0700 Subject: [PATCH 33/89] second set of fixes --- detections/endpoint/adsisearcher_account_discovery.yml | 8 ++++---- .../endpoint/cmd_carry_out_string_command_parameter.yml | 5 ++--- detections/endpoint/creation_of_shadow_copy.yml | 2 +- .../detect_credential_dumping_through_lsass_access.yml | 2 +- .../endpoint/detect_excessive_user_account_lockouts.yml | 7 +------ detections/endpoint/detect_html_help_renamed.yml | 5 ++--- detections/endpoint/detect_mshta_renamed.yml | 5 ++--- .../detect_prohibited_applications_spawning_cmd_exe.yml | 5 ++--- detections/endpoint/drop_icedid_license_dat.yml | 8 ++++---- .../endpoint/elevated_group_discovery_with_powerview.yml | 2 +- ...domainpasswordpolicy_with_powershell_script_block.yml | 9 ++++----- .../endpoint/get_aduser_with_powershell_script_block.yml | 8 ++++---- .../get_domainuser_with_powershell_script_block.yml | 8 ++++---- ...iobject_group_discovery_with_script_block_logging.yml | 2 +- .../endpoint/getadgroup_with_powershell_script_block.yml | 7 +++---- .../getcurrent_user_with_powershell_script_block.yml | 4 ++-- .../icedid_exfiltrated_archived_file_creation.yml | 8 ++++---- ...beros_service_ticket_request_using_rc4_encryption.yml | 3 +-- ...linux_account_manipulation_of_ssh_config_and_keys.yml | 6 +++++- detections/endpoint/linux_deletion_of_cron_jobs.yml | 6 +++++- .../endpoint/linux_deletion_of_init_daemon_script.yml | 6 +++++- .../endpoint/linux_deletion_of_ssl_certificate.yml | 6 +++++- ...ux_high_frequency_of_file_deletion_in_boot_folder.yml | 6 +++++- ...nux_high_frequency_of_file_deletion_in_etc_folder.yml | 6 +++++- 24 files changed, 73 insertions(+), 61 deletions(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 778f857b56..a2de72cfc7 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -13,7 +13,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Computer ScriptBlockText UserID + as firstTime max(_time) as lastTime by EventCode Computer ScriptBlockText UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -31,16 +31,16 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: powershell process having commandline $Message$ for user enumeration + message: Powershell process having commandline $ScriptBlockText$ used for user enumeration on $dest$ mitre_attack_id: - T1087.002 - T1087 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: UserID + - name: user type: User role: - Victim diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index ca7074bc1e..787af1c0ec 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="* - /c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name + /c *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`' @@ -56,8 +56,7 @@ tags: cve: - CVE-2021-44228 impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ attempting spawn a new process. + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. mitre_attack_id: - T1059.003 - T1059 diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index cdb2792e49..e59dd0cab6 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user - Processes.process_name Processes.process Processes.parent_process Processes.process_id + Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index ffcf2e0b12..765f2c4e02 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -32,7 +32,7 @@ tags: asset_type: Windows confidence: 100 impact: 80 - message: The $source_image$ has attempted access to read $TargetImage$ was identified + message: The $SourceImage$ has attempted access to read $TargetImage$ was identified on endpoint $dest$, this is indicative of credential dumping and should be investigated. mitre_attack_id: diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 3f9ba0a98d..2644b27abc 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -26,8 +26,7 @@ tags: asset_type: Windows confidence: 60 impact: 60 - message: Multiple accounts have been locked out. Review $nodename$ and $result$ - related to $user$. + message: Excessive user account lockouts for $user$ in a short period of time mitre_attack_id: - T1078 - T1078.003 @@ -36,10 +35,6 @@ tags: type: User role: - Victim - - name: result - type: Other - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 27efe7de4c..de16d4386f 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -46,8 +46,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$. + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ executed by $user$ mitre_attack_id: - T1218 - T1218.001 @@ -56,7 +55,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 29581ca7de..2765370da8 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -39,8 +39,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: The following $process_name$ has been identified as renamed, spawning from - $parent_process_name$. + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ executed by user $user$ mitre_attack_id: - T1218 - T1218.005 @@ -49,7 +48,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index db557ac2ae..e5b50e6f9f 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -36,8 +36,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$ running prohibited applications. + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. mitre_attack_id: - T1059 - T1059.003 @@ -46,7 +45,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index 660afbd740..7cb58503e9 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 11 search: '`sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time) - as lastTime by TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + as lastTime by TargetFilename EventCode process_id process_name Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -27,16 +27,16 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + message: A process $process_name$ create a file $TargetFilename$ on host $dest$ mitre_attack_id: - T1204 - T1204.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: SourceImage + - name: process_name type: Process role: - Attacker diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 75ca964e34..2a5635e87c 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -17,7 +17,7 @@ data_source: search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | rename ComputerName as dest, User as user | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 91b8958f1d..3ccd474b43 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -14,7 +14,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -30,16 +30,15 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: powershell process having commandline $Message$ to query domain password - policy + message: Powershell process having commandline $ScriptBlockText$ to query domain password policy on $dest$ mitre_attack_id: - T1201 observable: - - name: ComputerName + - name: dest type: Hostname role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 24b617bd7b..0b7fddbed5 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -14,7 +14,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + ScriptBlockText Computer UserID | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -30,16 +30,16 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: powershell process having commandline $Message$ for user enumeration + message: Powershell process having commandline $ScriptBlockText$ for user enumeration on $dest$ mitre_attack_id: - T1087.002 - T1087 observable: - - name: ComputerName + - name: dest type: Hostname role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 0e2d6b7b33..ce9ac55bc1 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -14,7 +14,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Computer UserID | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -28,16 +28,16 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: powershell process having commandline $Message$ for user enumeration + message: Powershell process having commandline $ScriptBlockText$ for user enumeration on $dest$ mitre_attack_id: - T1087.002 - T1087 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: UserID + - name: user type: User role: - Victim diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index c964f3a42d..a7596529f1 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -22,7 +22,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText = "*Win32_Group*" | stats count min(_time) as firstTime max(_time) as lastTime by - EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` + EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_with_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 1e1a3355aa..28fd99b2e3 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -13,8 +13,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*" | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer - user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -47,8 +46,8 @@ tags: - _time - EventCode - Message - - ComputerName - - User + - Computer + - UserID risk_score: 15 security_domain: endpoint tests: diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index 3ecca28632..ddd5a9f185 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -14,7 +14,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*" ScriptBlockText = "*GetCurrent()*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` + by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 30 - message: System user discovery on $dest$ + message: System user discovery on $dest$ by $user$ mitre_attack_id: - T1033 observable: diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 71682a28b8..f764099dfa 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -12,7 +12,7 @@ data_source: - Sysmon Event ID 11 search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by - TargetFilename EventCode process_id process_name Computer | `security_content_ctime(firstTime)` + TargetFilename EventCode process_id process_name Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -27,16 +27,16 @@ tags: asset_type: Endpoint confidence: 90 impact: 80 - message: process $SourceImage$ create a file $TargetImage$ in host $Computer$ + message: Process $process_name$ create a file $TargetImage$ in host $dest$ mitre_attack_id: - T1560.001 - T1560 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: SourceImage + - name: process_name type: Process role: - Attacker diff --git a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml index b5f72ec88e..e7f1ce59ed 100644 --- a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml +++ b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml @@ -44,8 +44,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 90 - message: A Kerberos Service TTicket request with RC4 encryption was requested from - $Client_Address$ + message: A Kerberos Service TTicket request with RC4 encryption was requested from $dest$ mitre_attack_id: - T1558 - T1558.001 diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml index f2f343371f..51b758c619 100644 --- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml @@ -35,7 +35,7 @@ tags: asset_type: endpoint confidence: 70 impact: 70 - message: a $process_name$ deleting a SSH key in $dest$ + message: SSH Config and keys are deleted on $dest$ by Process GUID - $process_guid$ mitre_attack_id: - T1485 - T1070.004 @@ -45,6 +45,10 @@ tags: type: Hostname role: - Victim + - name: process_guid + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index 4e851873b7..e13e11495f 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -35,7 +35,7 @@ tags: asset_type: endpoint confidence: 70 impact: 70 - message: a $process_name$ deleting cron jobs in $dest$ + message: Linux cron jobs are deleted on host $dest$ by process GUID- $process_guid$ mitre_attack_id: - T1485 - T1070.004 @@ -45,6 +45,10 @@ tags: type: Hostname role: - Victim + - name: process_guid + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 52b9b4bbaf..7c1ab2ee37 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -37,7 +37,7 @@ tags: asset_type: endpoint confidence: 70 impact: 70 - message: a $process_name$ deleting a daemon script in $dest$ + message: Init daemon script deleted on host $dest$ by process GUID- $process_guid$ mitre_attack_id: - T1485 - T1070.004 @@ -47,6 +47,10 @@ tags: type: Hostname role: - Victim + - name: process_guid + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index e1b58f85e6..fd52a426e5 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -36,7 +36,7 @@ tags: asset_type: endpoint confidence: 70 impact: 70 - message: a $process_name$ deleting a SSL certificate in $dest$ + message: SSL certificate deleted on host $dest$ by process GUID- $process_guid$ mitre_attack_id: - T1485 - T1070.004 @@ -46,6 +46,10 @@ tags: type: Hostname role: - Victim + - name: process_guid + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index 7e520ee8e6..7f66749d45 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -36,7 +36,7 @@ tags: asset_type: endpoint confidence: 80 impact: 100 - message: a $process_name$ deleting multiple files in /boot/ folder in $dest$ + message: Multiple files detection in /boot/ folder on $dest$ by process GUID - $process_guid$ mitre_attack_id: - T1485 - T1070.004 @@ -46,6 +46,10 @@ tags: type: Hostname role: - Victim + - name: process_guid + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 59eb6fc4dd..b8f38ac6c9 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -35,7 +35,7 @@ tags: asset_type: endpoint confidence: 70 impact: 70 - message: a $process_name$ deleting multiple files in /etc/ folder in $dest$ + message: Multiple files delted in /etc/ folder on $dest$ by process GUID - $process_guid$ mitre_attack_id: - T1485 - T1070.004 @@ -45,6 +45,10 @@ tags: type: Hostname role: - Victim + - name: process_guid + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security From db49b5500d3a9720975b3519898b6a6cdf806ea8 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 22 Sep 2023 15:57:31 -0700 Subject: [PATCH 34/89] last one --- detections/endpoint/linux_deletion_of_services.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index e5254716b4..35b9511e79 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -39,7 +39,7 @@ tags: asset_type: endpoint confidence: 80 impact: 80 - message: a $process_name$ deleting a services in $dest$ + message: A services file $file_name$ deteted on host $dest$ by process GUID - $process_guid$ mitre_attack_id: - T1485 - T1070.004 @@ -49,6 +49,10 @@ tags: type: Hostname role: - Victim + - name: process_guid + type: Process + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security From dee08b262a71bc6e306d93297ad5dcee11e410cb Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 22 Sep 2023 15:59:07 -0700 Subject: [PATCH 35/89] minor fix --- detections/cloud/o365_add_app_role_assignment_grant_user.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index fd9206dd2c..217c60ab6d 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -11,7 +11,7 @@ description: This search is designed to detect the creation of a new Federation providing an additional layer of security for your environment. data_source: [] search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." - | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type values(ModifiedProperties{}.Name) as modified_properties_name by user dest ResultStatus Operation + | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type values(ModifiedProperties{}.Name) as modified_properties_name by user dest ResultStatus Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' @@ -30,7 +30,7 @@ tags: asset_type: Office 365 confidence: 60 impact: 30 - message: User $Actor.ID$ has created a new federation setting $modified_properties_name$ on $dest$ + message: User $user$ has created a new federation setting $modified_properties_name$ on $dest$ mitre_attack_id: - T1136.003 - T1136 From e9b0b6fcdb548ae60c42d5a62c7b2660fce09bb1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 22 Sep 2023 16:05:31 -0700 Subject: [PATCH 36/89] update status to deprecated --- .../detect_mimikatz_using_loaded_images.yml | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/detections/deprecated/detect_mimikatz_using_loaded_images.yml index f7eb47d242..fa1a5f1ce8 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/detections/deprecated/detect_mimikatz_using_loaded_images.yml @@ -3,11 +3,10 @@ id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 version: 1 date: '2019-12-03' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: TTP description: This search looks for reading loaded Images unique to credential dumping - with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon - Event Code. + with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId) @@ -40,7 +39,7 @@ tags: confidence: 80 impact: 80 message: A process, $Image$, has loaded $ImageLoaded$ that are typically related - to credential dumping on $Computer$. Review for further details. + to credential dumping on $dest$. Review for further details. mitre_attack_id: - T1003.001 - T1003 @@ -49,18 +48,10 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim - - name: ImageLoaded - type: Process - role: - - Other - - name: Image - type: Process - role: - - Child Process product: - Splunk Enterprise - Splunk Enterprise Security From b3dc3476aaa6bfeff6f2a4383cba7952f4e28e25 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 22 Sep 2023 17:10:03 -0700 Subject: [PATCH 37/89] Fix a large number of searches with observable issues. Discuss with team before merging changes. --- detections/endpoint/net_profiler_uac_bypass.yml | 2 +- .../network_share_discovery_via_dir_command.yml | 2 +- detections/endpoint/powershell_4104_hunting.yml | 13 ++----------- ...calgroup_discovery_with_script_block_logging.yml | 6 +++--- .../process_deleting_its_process_file_path.yml | 2 +- detections/endpoint/spoolsv_spawning_rundll32.yml | 4 ++-- ...covery_with_env_vars_powershell_script_block.yml | 4 ++-- ...ion_layer_protocol_rms_radmin_tool_namedpipe.yml | 2 +- ...scripting_interpreter_hunting_path_traversal.yml | 2 +- ...nd_scripting_interpreter_path_traversal_exec.yml | 2 +- .../endpoint/windows_identify_protocol_handlers.yml | 2 +- .../windows_linked_policies_in_adsi_discovery.yml | 2 +- detections/endpoint/windows_nirsoft_utilities.yml | 2 +- .../windows_non_system_account_targeting_lsass.yml | 2 +- ...ndows_raw_access_to_master_boot_record_drive.yml | 2 +- .../windows_replication_through_removable_media.yml | 4 ++-- ...indows_root_domain_linked_policies_discovery.yml | 2 +- .../windows_security_account_manager_stopped.yml | 2 +- .../endpoint/windows_service_stop_by_deletion.yml | 2 +- .../endpoint/windows_service_stop_win_updates.yml | 2 +- ...t_of_invalid_users_failed_to_auth_using_ntlm.yml | 2 +- ...ws_valid_account_with_never_expires_password.yml | 2 +- .../endpoint/windows_wmi_impersonate_token.yml | 2 +- .../splunk_identified_ssl_tls_certificates.yml | 4 ++-- 24 files changed, 31 insertions(+), 40 deletions(-) diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index f06cf03713..0416cdfd38 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -33,7 +33,7 @@ tags: confidence: 90 impact: 70 message: Suspicious modification of registry $registry_path$ with possible payload - path $registry_value_name$ in $dest$ + path $registry_path$ and key $registry_key_name$ in $dest$ mitre_attack_id: - T1548.002 - T1548 diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index 5239d08a16..89b49c88d7 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -35,7 +35,7 @@ tags: confidence: 50 impact: 50 message: $user$ list executable files or directory in known sensitive SMB share. Share - name=$Share_Name$, Access mask=$Access_Mask$ + name=$ShareName$, Access mask=$AccessMask$ mitre_attack_id: - T1135 observable: diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 38f68b2011..5bcfe78032 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -37,7 +37,7 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, - invokecmd, base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, + invokecmd, base64, get | stats values(Score) by UserID, Computer, DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs @@ -63,8 +63,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $Computer$ by user $user$ executing suspicious commands. + message: Powershell was identified on endpoint $Computer$ by user $UserID$ executing suspicious commands. mitre_attack_id: - T1059 - T1059.001 @@ -77,14 +76,6 @@ tags: type: Hostname role: - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 0ae63093a2..d6351797cf 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -41,16 +41,16 @@ tags: asset_type: Endpoint confidence: 50 impact: 30 - message: Local group discovery on $dest$ by $user$. + message: Local group discovery on $Computer$ by $UserID$. mitre_attack_id: - T1069 - T1069.001 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim - - name: user + - name: UserID type: User role: - Victim diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index babbb462ed..5600e1845b 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -37,7 +37,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 60 - message: A process $Image$ tries to delete its process path in commandline $cmdline$ + message: A process $Image$ tries to delete its process path in commandline $CommandLine$ as part of defense evasion in host $Computer$ mitre_attack_id: - T1070 diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 24a8fb1494..fd747f6963 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe - `process_rundll32` by Processes.dest Processes.user Processes.parent_process Processes.original_file_name + `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_spawning_rundll32_filter`' @@ -42,7 +42,7 @@ tags: cve: - CVE-2021-34527 impact: 80 - message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. + message: $parent_process_name$ has spawned $process_name$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. mitre_attack_id: - T1547.012 diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index ba10f49c0b..245ee554b9 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -29,11 +29,11 @@ tags: asset_type: Endpoint confidence: 50 impact: 30 - message: System user discovery on $dest$ + message: System user discovery on $Computer$ mitre_attack_id: - T1033 observable: - - name: dest + - name: Computer type: Endpoint role: - Victim diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml index dbf44490dc..7f87ae55db 100644 --- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml +++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml @@ -34,7 +34,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: possible RMS admin tool named pipe was created in $dest$ + message: possible RMS admin tool named pipe was created in $Computer$ mitre_attack_id: - T1071 observable: diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index 2e817e87c1..7488e771d8 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -17,7 +17,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process | `drop_dm_object_name("Processes")` + Processes.parent_process_name Processes.process_name Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1) | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 764448a769..4603c6958e 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -16,7 +16,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index 07ae69911e..544251cf40 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -16,7 +16,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) - as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user + as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.parent_process_name Processes.user Processes.process_name Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter`' diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index e954bb5b34..29bee5ec15 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: powershell process having commandline $Message$ for user enumeration + message: powershell process having commandline $ScriptBlockText$ for user enumeration on $Computer$ mitre_attack_id: - T1087.002 - T1087 diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 693acfbeab..136a4d60cc 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -11,7 +11,7 @@ description: The following hunting analytic assists with identifying the proces data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process + as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `is_nirsoft_software` diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 7d3ff261b8..d46ad6ccd1 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -35,7 +35,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A process, $parent_process_path$, has loaded $ImageLoaded$ that are typically related + message: A process, $parent_process_path$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. mitre_attack_id: - T1003.001 diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index e9ddffbcac..6bef4c0403 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -39,7 +39,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 90 - message: process accessing MBR $device$ in $dest$ + message: process accessing MBR $device$ on $Computer$ mitre_attack_id: - T1561.002 - T1561 diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 54bc7b0cf6..2579c8a2c2 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -24,7 +24,7 @@ search: '|tstats `security_content_summariesonly` count min(_time) as firstTime = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name = *.js OR Filesystem.file_name= *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name = *.pif) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.user | `drop_dm_object_name(Filesystem)` | eval + Filesystem.file_path Filesystem.user Filesystem.dest | `drop_dm_object_name(Filesystem)` | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: executable or script $file_path$ was drop in root drive $root_drive$ in + message: executable or script $file_path$ was dropped in root drive $root_drive$ in $dest$ mitre_attack_id: - T1091 diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index 89cd8dfcdb..3d17582330 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: powershell process having commandline $Message$ for user enumeration + message: powershell process having commandline $ScriptBlockText$ for user enumeration on $Computer$ mitre_attack_id: - T1087.002 - T1087 diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index a4ff3fe6d6..053484f91c 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -34,7 +34,7 @@ tags: confidence: 100 impact: 70 message: 'The Windows Security Account Manager (SAM) was stopped via cli by $user$ - on $dest$ by this command: $processs$' + on $dest$ by this command: $process$' mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index 2fd1d18c95..167980885d 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -15,7 +15,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) - Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process + Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`' diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml index b8d5271570..7782d42eac 100644 --- a/detections/endpoint/windows_service_stop_win_updates.yml +++ b/detections/endpoint/windows_service_stop_win_updates.yml @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: Windows update services $service_name$ was being disabled on $dest$ + message: Windows update services $service_name$ was being disabled on $Computer$ mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml index 1e60e7ac16..89c7842f63 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -52,7 +52,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_valid_account_with_never_expires_password.yml index ab08d1197e..45d340c357 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/endpoint/windows_valid_account_with_never_expires_password.yml @@ -16,7 +16,7 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="* accounts *" AND Processes.process="* - /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name + /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`' diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 18908f2f7c..39a79b61e5 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -35,7 +35,7 @@ tags: confidence: 50 impact: 50 message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ - to $TargetImage$ process in $dest$ + to $TargetImage$ process in $Computer$ mitre_attack_id: - T1047 observable: diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index 019b222da7..01e61b7d7f 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -35,11 +35,11 @@ tags: - CVE-2022-32151 - CVE-2022-32152 impact: 60 - message: The following $dest$ is using the self signed Splunk certificate. + message: The following $host$ is using the self signed Splunk certificate. mitre_attack_id: - T1040 observable: - - name: dest + - name: host type: Hostname role: - Victim From 4e213c100d2b5c32a6320ca76018ec204c302b06 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Sep 2023 18:05:49 +0200 Subject: [PATCH 38/89] njrat2 --- ..._modify_registry_with_md5_reg_key_name.yml | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml new file mode 100644 index 0000000000..718b0583bf --- /dev/null +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -0,0 +1,67 @@ +name: 'Windows Modify Registry With MD5 Reg Key Name' +id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 +version: 1 +date: '2023-09-25' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: This analytic is designed to identify potentially malicious registry modification characterized by MD5-like registry key names. + This technique has been notably observed in NjRAT malware, which employs such registries for fileless storage of keylogs and .DLL plugins. + Detecting this tactic serves as an effective means of identifying possible NjRAT malware instances that create or modify registries as + part of their malicious activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | eval dropped_reg_path = split(registry_path, "\\") + | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) + | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"good","bad") + | where validation_result = "good" AND dropped_reg_path_split_count <= 5 + | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_with_md5_reg_key_name_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that + include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: unknown +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat +tags: + analytic_story: + - NjRAT + asset_type: Endpoint + confidence: 60 + impact: 60 + message: a md5 registry value name is created in $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 36 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 9c341bc954e9f5622359c9624de2402d692548a4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Sep 2023 18:09:25 +0200 Subject: [PATCH 39/89] njrat2 --- .../endpoint/windows_modify_registry_with_md5_reg_key_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 718b0583bf..6eb7bec4a7 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim | `drop_dm_object_name(Registry)` | eval dropped_reg_path = split(registry_path, "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) - | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"good","bad") + | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") | where validation_result = "good" AND dropped_reg_path_split_count <= 5 | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` From 648df38a1a94792c1d28acf176b5e7789023a482 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 25 Sep 2023 18:11:06 +0200 Subject: [PATCH 40/89] njrat2 --- .../endpoint/windows_modify_registry_with_md5_reg_key_name.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 6eb7bec4a7..16744a0ce7 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim | eval dropped_reg_path = split(registry_path, "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") - | where validation_result = "good" AND dropped_reg_path_split_count <= 5 + | where validation_result = "md5" AND dropped_reg_path_split_count <= 5 | table dest user registry_path registry_value_name registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` From 3743f161a8119cd112244adf26084abff685963c Mon Sep 17 00:00:00 2001 From: Namratha Sreekanta Date: Mon, 25 Sep 2023 12:55:51 -0700 Subject: [PATCH 41/89] DGA Performance fix --- notebooks/pretrained_dga_model_dsdl.ipynb | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/notebooks/pretrained_dga_model_dsdl.ipynb b/notebooks/pretrained_dga_model_dsdl.ipynb index 1d80c0c695..fad7ff971b 100644 --- a/notebooks/pretrained_dga_model_dsdl.ipynb +++ b/notebooks/pretrained_dga_model_dsdl.ipynb @@ -25,7 +25,7 @@ "cell_type": "markdown", "metadata": {}, "source": [ - "Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for Command And Control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the Command And Control channel, as there potentially could be thousands of domains that malware can check for instructions.\n", + "Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.\n", "\n", "DGAs can take the form of apparently random or \"gibberish\" strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders https://attack.mitre.org/techniques/T1568/002/" ] @@ -40,7 +40,7 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 32, "metadata": { "deletable": false, "name": "mltkc_import" @@ -228,8 +228,7 @@ "\n", " \n", "def is_in_alexa1m(domain,domains):\n", - " test_in_alexa_domains = set(alexa_domains) & domains\n", - " return ((domain in test_in_alexa_domains))\n", + " return ((domain in domains))\n", "\n", " \n", " \n", @@ -241,13 +240,13 @@ " print (\"2. Done adding entropy\")\n", " X_4 = df['domain'].map(lambda x: len(x))\n", " print (\"3. Done adding length of domain\")\n", - " domains = set(df['domain'])\n", - " X_5 = df['domain'].map(lambda x: is_in_alexa1m(x,domains))\n", + " in_alexa = set(alexa_domains) & set(df['domain'])\n", + " X_5 = df['domain'].map(lambda x: is_in_alexa1m(x, in_alexa))\n", " print (\"4. Done adding domain present in alexa domains\")\n", " X_5 = X_5.astype(int)\n", " input2 = np.c_[X_1,X_2,X_3,X_4,X_5] #\n", " print (\"appending done\")\n", - " return input2 \n", + " return input2\n", "\n", "def prep_text(texts):\n", " text_sequences = tokenizer.texts_to_sequences(texts)\n", @@ -309,7 +308,7 @@ }, { "cell_type": "code", - "execution_count": null, + "execution_count": 3, "metadata": { "deletable": false, "name": "mltkc_load" @@ -369,7 +368,7 @@ ], "metadata": { "kernelspec": { - "display_name": "Python 3", + "display_name": "Python 3 (ipykernel)", "language": "python", "name": "python3" }, @@ -383,7 +382,7 @@ "name": "python", "nbconvert_exporter": "python", "pygments_lexer": "ipython3", - "version": "3.8.5" + "version": "3.9.13" } }, "nbformat": 4, From 2d7c9efdd55075036e0026441674dacafe328ad0 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 25 Sep 2023 13:27:58 -0700 Subject: [PATCH 42/89] Search improvements --- .../application/splunk_dos_using_malformed_saml_request.yml | 4 ++-- .../splunk_reflected_xss_on_app_search_table_endpoint.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml index c9f5d57882..2d3643a91d 100644 --- a/detections/application/splunk_dos_using_malformed_saml_request.yml +++ b/detections/application/splunk_dos_using_malformed_saml_request.yml @@ -8,8 +8,8 @@ type: Hunting data_source: - splunkd.log description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang. -search: '`splunkd` message=*error* expr=*xpointer* | stats count by component expr host event_message | `splunk_dos_using_malformed_saml_request_filter`' -how_to_implement: Must have access to internal indexes. +search: '`splunkd` event_message=*error* expr=*xpointer* | stats count by component expr host event_message | `splunk_dos_using_malformed_saml_request_filter`' +how_to_implement: To run this search, you must have access to the _internal index. known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. references: - https://advisory.splunk.com/advisories/SVD-2023-0802 diff --git a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml index 1f138e36db..8f6d8be7c1 100644 --- a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml +++ b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -8,7 +8,7 @@ type: Hunting data_source: - web_access.log description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the app search table web endpoint, which presents as the Create Table View page in Splunk Web. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. A JavaScript file within this web endpoint does not properly validate input which lets an attacker insert a payload into a function. -search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats earliest(_time) as event_time count by clientip status user view root uri_path | convert ctime(*time) | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' +search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats earliest(_time) as event_time count by clientip status user view root uri_path | convert ctime(event_time) | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' how_to_implement: Need access to the internal indexes. known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string. references: From f37be10450d689668d6ba68e65ec381bebbfc35d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 25 Sep 2023 14:39:21 -0700 Subject: [PATCH 43/89] Add timing to searches --- .../splunk_absolute_path_traversal_using_runshellscript.yml | 3 ++- .../splunk_cmd_injection_using_external_lookups.yml | 4 ++-- .../application/splunk_dos_using_malformed_saml_request.yml | 2 +- .../splunk_reflected_xss_on_app_search_table_endpoint.yml | 2 +- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index ca40ac3d4f..f4bf36e7c1 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -8,7 +8,8 @@ type: Hunting data_source: - python.log description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. -search: '`splunk_python` *runshellscript* | `splunk_absolute_path_traversal_using_runshellscript_filter`' +search: '`splunk_python` *runshellscript* | stats count min(_time) + as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter`' how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml index bde67675e2..57f502c01a 100644 --- a/detections/application/splunk_cmd_injection_using_external_lookups.yml +++ b/detections/application/splunk_cmd_injection_using_external_lookups.yml @@ -8,8 +8,8 @@ type: Hunting data_source: - audittrial description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. -search: '`audit_searches` search = "| *runshellscript* """ | stats earliest(_time) as event_time count by search user splunk_server - | convert ctime(event_time) | `splunk_cmd_injection_using_external_lookups_filter`' +search: '`audit_searches` search = "| *runshellscript* """ | stats count min(_time) as firstTime max(_time) as lastTime by search user splunk_server + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_cmd_injection_using_external_lookups_filter`' how_to_implement: Must have access to internal audit index. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml index 2d3643a91d..0469e670d0 100644 --- a/detections/application/splunk_dos_using_malformed_saml_request.yml +++ b/detections/application/splunk_dos_using_malformed_saml_request.yml @@ -8,7 +8,7 @@ type: Hunting data_source: - splunkd.log description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang. -search: '`splunkd` event_message=*error* expr=*xpointer* | stats count by component expr host event_message | `splunk_dos_using_malformed_saml_request_filter`' +search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr host event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`' how_to_implement: To run this search, you must have access to the _internal index. known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. references: diff --git a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml index 8f6d8be7c1..fb9e6baef2 100644 --- a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml +++ b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -8,7 +8,7 @@ type: Hunting data_source: - web_access.log description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the app search table web endpoint, which presents as the Create Table View page in Splunk Web. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. A JavaScript file within this web endpoint does not properly validate input which lets an attacker insert a payload into a function. -search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats earliest(_time) as event_time count by clientip status user view root uri_path | convert ctime(event_time) | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' +search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time) as firstTime max(_time) as lastTime by clientip status user view root uri_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' how_to_implement: Need access to the internal indexes. known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string. references: From f37ada7cf9cb433f97b057863940abdca0848693 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 25 Sep 2023 15:02:52 -0700 Subject: [PATCH 44/89] fix search and notable --- ...k_absolute_path_traversal_using_runshellscript.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index f4bf36e7c1..9f4620f644 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -8,8 +8,7 @@ type: Hunting data_source: - python.log description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. -search: '`splunk_python` *runshellscript* | stats count min(_time) - as firstTime max(_time) as lastTime | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter`' +search: '`splunk_python` *runshellscript* | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter`' how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: @@ -20,16 +19,16 @@ tags: asset_type: endpoint confidence: 70 impact: 50 - message: Possible attack abusing runshellscript + message: Possible attack against splunk_server $splunk_server$ through abuse of runshellscript SPL command mitre_attack_id: - T1083 cve: - CVE-2023-40597 observable: - - name: other - type: Unknown + - name: splunk_server + type: Hostname role: - - Unknown + - Victim product: - Splunk Enterprise - Splunk Enterprise Security From 46f183d8b747e7fc7ee59eb71273622b23ae9aeb Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 26 Sep 2023 09:19:50 -0700 Subject: [PATCH 45/89] Parse out fields for runshellscript search --- ...lute_path_traversal_using_runshellscript.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index 9f4620f644..8b114b91a5 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -8,7 +8,20 @@ type: Hunting data_source: - python.log description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. -search: '`splunk_python` *runshellscript* | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter`' +search: > + index=_internal sourcetype=splunk_python *runshellscript* + | eval log_split=split(_raw, "runshellscript: ") + | eval array_raw = mvindex(log_split,1) + | eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","") + | eval array_indices=split(data_cleaned,",") + | eval runshellscript_args_count=mvcount(array_indices) + | where runshellscript_args_count = 10 + | eval interpreter=mvindex(array_indices,0) + | eval targetScript=mvindex(array_indices,1) + | eval filename=mvindex(array_indices,9) + | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter targetScript filename + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `splunk_absolute_path_traversal_using_runshellscript_filter` how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. references: @@ -19,7 +32,7 @@ tags: asset_type: endpoint confidence: 70 impact: 50 - message: Possible attack against splunk_server $splunk_server$ through abuse of runshellscript SPL command + message: Possible attack against splunk_server $splunk_server$ through abuse of the runshellscript command mitre_attack_id: - T1083 cve: From b2d1f4f1ad01ecbe17383eaed99a1e7b60ee0a5d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 26 Sep 2023 14:03:04 -0700 Subject: [PATCH 46/89] minor change for creating PR --- detections/network/detect_arp_poisoning.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml index 1e6f23b772..6db2bfa487 100644 --- a/detections/network/detect_arp_poisoning.yml +++ b/detections/network/detect_arp_poisoning.yml @@ -1,5 +1,5 @@ name: Detect ARP Poisoning -id: b44bebd6-bd39-467b-9321-73971bcd7aac +id: b44bebd6-bd39-467b-9321-73971bcd1aac version: 1 date: '2020-08-11' author: Mikael Bjerkeland, Splunk From 2076a91d12756c94b7e0cf20025f478f31268e32 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 14:56:11 -0700 Subject: [PATCH 47/89] adding dest --- detections/endpoint/windows_admin_permission_discovery.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml index 0a9e36204a..c333138174 100644 --- a/detections/endpoint/windows_admin_permission_discovery.yml +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -16,7 +16,7 @@ description: This analytic is developed to identify suspicious file creation in similar techniques to assess the privileges of their running malware instances, without using token privilege API calls or PowerShell commandlets. search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", "*.lnk", "*.dat") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.user + by Filesystem.dest Filesystem.file_create_time Filesystem.process_id Filesystem.process_guiid Filesystem.file_name Filesystem.file_path Filesystem.user | `drop_dm_object_name(Filesystem)` | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) @@ -35,7 +35,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: a file was created in root drive c in $dest$ + message: A file was created in root drive C:/ on host - $dest$ mitre_attack_id: - T1069.001 observable: From 67b6e4749fe29395644ef8183938c9d73bf0eaec Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 14:57:04 -0700 Subject: [PATCH 48/89] Update windows_delete_or_modify_system_firewall.yml --- .../endpoint/windows_delete_or_modify_system_firewall.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml index a5487b6bd7..ff8d9b2fa2 100644 --- a/detections/endpoint/windows_delete_or_modify_system_firewall.yml +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a $process_name$ delete firewall configuration in $dest$ + message: A $process_name$ deleted a firewall configuration on $dest$ mitre_attack_id: - T1562 - T1562.004 From d3e104c3f3a2ab30a3fc27753e8bf980855d09b5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 14:58:14 -0700 Subject: [PATCH 49/89] Update windows_disable_or_modify_tools_via_taskkill.yml --- .../endpoint/windows_disable_or_modify_tools_via_taskkill.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index c9a8faee16..d5ae1d6cff 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a taskkill process to terminate process is executed in $dest$ + message: A taskkill process to terminate process is executed on host- $dest$ mitre_attack_id: - T1562 - T1562.001 From d0e387f41a3d2bceaba30e5775ee0c248b65fd0b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:37:28 -0700 Subject: [PATCH 50/89] Update windows_delete_or_modify_system_firewall.yml updates to text and spl --- ...ndows_delete_or_modify_system_firewall.yml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml index ff8d9b2fa2..5b81bcb763 100644 --- a/detections/endpoint/windows_delete_or_modify_system_firewall.yml +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -12,17 +12,22 @@ description: This analytic identifies potentially malicious 'netsh' processes th Leveraging this anomaly detection can be a valuable approach for detecting malware, such as NJRAT, that makes alterations to firewall configurations as a component of its malicious activities. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "netsh.exe" Processes.process = "* firewall *" Processes.process = "* delete *" - by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest + where `process_netsh` Processes.process = "* firewall *" Processes.process = "* delete *" + by Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_delete_or_modify_system_firewall_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: administrator may modify or delete firewall configuration. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrator may modify or delete firewall configuration. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat tags: From c5e942e24ada678c65427d4efc3eee153a168959 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:38:24 -0700 Subject: [PATCH 51/89] Update windows_disable_or_modify_tools_via_taskkill.yml how to implement --- ...ndows_disable_or_modify_tools_via_taskkill.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index d5ae1d6cff..593aba2a37 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -18,11 +18,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_or_modify_tools_via_taskkill_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -known_false_positives: network administrator can use this application to kill process during audit or investigation. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Network administrator can use this application to kill process during audit or investigation. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat tags: From 0bde5c7afecda3b93aa7c84366a190575567ee28 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:40:05 -0700 Subject: [PATCH 52/89] Update windows_modify_registry_with_md5_reg_key_name.yml --- .../windows_modify_registry_with_md5_reg_key_name.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 16744a0ce7..360ef3d78d 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -1,4 +1,4 @@ -name: 'Windows Modify Registry With MD5 Reg Key Name' +name: Windows Modify Registry With MD5 Reg Key Name id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 version: 1 date: '2023-09-25' @@ -36,7 +36,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a md5 registry value name is created in $dest$ + message: A md5 registry value name $registry_value_name$ is created on $dest$ mitre_attack_id: - T1112 observable: From 631ecd41221c4dec51a8a650cb9dffac134ac8d5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 27 Sep 2023 15:51:03 -0700 Subject: [PATCH 53/89] updating sutffff --- ...l => windows_executable_in_loaded_modules.yml} | 6 +++--- .../endpoint/windows_time_based_evasion.yml | 15 ++++++++++----- 2 files changed, 13 insertions(+), 8 deletions(-) rename detections/endpoint/{windows_shared_module_executable_in_loaded_modules.yml => windows_executable_in_loaded_modules.yml} (93%) diff --git a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml b/detections/endpoint/windows_executable_in_loaded_modules.yml similarity index 93% rename from detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml rename to detections/endpoint/windows_executable_in_loaded_modules.yml index 16d00138d0..092578b463 100644 --- a/detections/endpoint/windows_shared_module_executable_in_loaded_modules.yml +++ b/detections/endpoint/windows_executable_in_loaded_modules.yml @@ -1,4 +1,4 @@ -name: Windows Shared Module Executable in loaded Modules +name: Windows Executable in Loaded Modules id: 3e27af56-fcf0-4113-988d-24969b062be7 version: 1 date: '2023-09-12' @@ -18,7 +18,7 @@ search: '`sysmon` EventCode=7 ImageLoaded= *.exe | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_shared_module_executable_in_loaded_modules_filter`' + | `windows_executable_in_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown. @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: an executable as Imageloaded by $Image$ in $dest$ + message: An executable $Imageloaded$ loaded by $Image$ on $dest$ mitre_attack_id: - T1129 observable: diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 00b5693c1e..a9dc9ec64a 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -18,10 +18,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_time_based_evasion_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: unknown references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat @@ -31,7 +36,7 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: a $process_name$ did a suspicious ping to invalid ip address in $dest$ + message: A $process_name$ did a suspicious ping to invalid IP address on $dest$ mitre_attack_id: - T1497 - T1497.003 From 92a6c6f6944c70ec8463602dd96af6edf3e1294e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 10:52:21 -0700 Subject: [PATCH 54/89] Update dump_lsass_via_procdump_rename.yml --- detections/deprecated/dump_lsass_via_procdump_rename.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml index b8185cb381..fece52245f 100644 --- a/detections/deprecated/dump_lsass_via_procdump_rename.yml +++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml @@ -17,8 +17,7 @@ description: 'Detect a renamed instance of procdump.exe dumping the lsass proces data_source: - Sysmon Event ID 1 search: '`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 - (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | rename dest as - dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, + (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter`' how_to_implement: To successfully implement this search you need to be ingesting information From f8988b7d808c350979c7297f3208bf02e690cca1 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 10:53:01 -0700 Subject: [PATCH 55/89] Update cobalt_strike_named_pipes.yml --- detections/endpoint/cobalt_strike_named_pipes.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 3ff02ea6f5..df2eeb30af 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -22,8 +22,7 @@ data_source: search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*, \\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime - by dest, process_name, process_id process_path, PipeName | rename dest as - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by dest, process_name, process_id process_path, PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your From 4ba5bcb670ec27895fd21dc86346bba5c67cad13 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 10:58:04 -0700 Subject: [PATCH 56/89] Update windows_vulnerable_3cx_software.yml --- detections/endpoint/windows_vulnerable_3cx_software.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml index e749b51a87..663118cbcd 100644 --- a/detections/endpoint/windows_vulnerable_3cx_software.yml +++ b/detections/endpoint/windows_vulnerable_3cx_software.yml @@ -8,9 +8,7 @@ status: production data_source: - Sysmon Event Code 1 description: The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app. -search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe) FileVersion=18.12.* - - | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,process_name, OriginalFileName, CommandLine +search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe) FileVersion=18.12.* | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_vulnerable_3cx_software_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -63,4 +61,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog \ No newline at end of file + sourcetype: xmlwineventlog From 0d16ea4d80da9ad53e25a4018ed80d4f04a3c925 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 11:07:57 -0700 Subject: [PATCH 57/89] Update adsisearcher_account_discovery.yml --- detections/endpoint/adsisearcher_account_discovery.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index a2de72cfc7..85f50039f2 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Powershell process having commandline $ScriptBlockText$ used for user enumeration on $dest$ + message: Powershell process having commandline "AdsiSearcher" used for user enumeration on $dest$ mitre_attack_id: - T1087.002 - T1087 From 5bdfd1f170b937b1083524ff490d9525854bfc8e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 11:08:30 -0700 Subject: [PATCH 58/89] Update get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml --- ...defaultdomainpasswordpolicy_with_powershell_script_block.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 3ccd474b43..85ecebbf31 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: Powershell process having commandline $ScriptBlockText$ to query domain password policy on $dest$ + message: Powershell process having commandline "Get-ADDefaultDomainPasswordPolicy" to query domain password policy on $dest$ mitre_attack_id: - T1201 observable: From 2270cac53c285e098e686e14c6cc0dc7f87d94a9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 11:09:47 -0700 Subject: [PATCH 59/89] Update get_aduser_with_powershell_script_block.yml --- detections/endpoint/get_aduser_with_powershell_script_block.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 0b7fddbed5..d9adbe1106 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -30,7 +30,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Powershell process having commandline $ScriptBlockText$ for user enumeration on $dest$ + message: Powershell process having commandline "get-aduser" for user enumeration on $dest$ mitre_attack_id: - T1087.002 - T1087 From e5a814e78ecf7fd36a545a8cad0ffeccfe57c175 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Sep 2023 11:12:02 -0700 Subject: [PATCH 60/89] remove script block from message --- .../endpoint/get_domainuser_with_powershell_script_block.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index ce9ac55bc1..23446ccfdc 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -28,7 +28,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Powershell process having commandline $ScriptBlockText$ for user enumeration on $dest$ + message: Powershell process having commandline "*Get-DomainUser*" for user enumeration on $dest$ mitre_attack_id: - T1087.002 - T1087 From f76dfe427720032846a8376135f9314b74055f67 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 28 Sep 2023 13:37:36 -0700 Subject: [PATCH 61/89] Minor updates to improve notables and result rendering. --- .../splunk_absolute_path_traversal_using_runshellscript.yml | 3 +-- .../application/splunk_dos_using_malformed_saml_request.yml | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index 8b114b91a5..b39a416fbd 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -18,8 +18,7 @@ search: > | where runshellscript_args_count = 10 | eval interpreter=mvindex(array_indices,0) | eval targetScript=mvindex(array_indices,1) - | eval filename=mvindex(array_indices,9) - | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter targetScript filename + | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter targetScript | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter` how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml index 0469e670d0..88527398dc 100644 --- a/detections/application/splunk_dos_using_malformed_saml_request.yml +++ b/detections/application/splunk_dos_using_malformed_saml_request.yml @@ -8,7 +8,7 @@ type: Hunting data_source: - splunkd.log description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang. -search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr host event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`' +search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr splunk_server event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`' how_to_implement: To run this search, you must have access to the _internal index. known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. references: @@ -19,11 +19,11 @@ tags: asset_type: endpoint confidence: 30 impact: 50 - message: Possible DoS attack against $host$ + message: Possible DoS attack against Splunk Server $splunk_server$ mitre_attack_id: - T1498 observable: - - name: host + - name: splunk_server type: Hostname role: - Victim From 732aec3f955378cd6fe012b929ec14dca29a894f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 28 Sep 2023 14:51:28 -0700 Subject: [PATCH 62/89] Delete detection and migrate logic and documentation to risky command lookup file. Update macro to point to new risky command csv. Fiox some opservables. --- ...te_path_traversal_using_runshellscript.yml | 3 +- ...k_cmd_injection_using_external_lookups.yml | 49 ------------------- ...plunk_dos_using_malformed_saml_request.yml | 3 +- ...ected_xss_on_app_search_table_endpoint.yml | 3 +- ..._command_abuse_disclosed_february_2023.yml | 8 +++ lookups/splunk_risky_command.yml | 2 +- ....csv => splunk_risky_command_20231003.csv} | 24 ++++----- 7 files changed, 25 insertions(+), 67 deletions(-) delete mode 100644 detections/application/splunk_cmd_injection_using_external_lookups.yml rename lookups/{splunk_risky_command_20230830.csv => splunk_risky_command_20231003.csv} (80%) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index b39a416fbd..df8e1684c8 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -5,8 +5,7 @@ date: '2023-09-05' author: Rod Soto status: production type: Hunting -data_source: -- python.log +data_source: [] description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. search: > index=_internal sourcetype=splunk_python *runshellscript* diff --git a/detections/application/splunk_cmd_injection_using_external_lookups.yml b/detections/application/splunk_cmd_injection_using_external_lookups.yml deleted file mode 100644 index 57f502c01a..0000000000 --- a/detections/application/splunk_cmd_injection_using_external_lookups.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: Splunk Cmd Injection Using External Lookups -id: 901ae2e2-b47b-4adc-b296-a151a8fccdca -version: 1 -date: '2023-09-05' -author: Rod Soto -status: production -type: Hunting -data_source: -- audittrial -description: In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance. -search: '`audit_searches` search = "| *runshellscript* """ | stats count min(_time) as firstTime max(_time) as lastTime by search user splunk_server - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_cmd_injection_using_external_lookups_filter`' -how_to_implement: Must have access to internal audit index. -known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. -references: -- https://advisory.splunk.com/advisories/SVD-2023-0807 -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: endpoint - confidence: 50 - impact: 30 - message: Possible exploitation attempt against $host$ - mitre_attack_id: - - T1202 - cve: - - CVE-2023-40598 - observable: - - name: host - type: Hostname - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - risk_score: 15 - required_fields: - - search - - user - - splunk_server - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log - source: audittrail - sourcetype: audittrail - custom_index: _audit diff --git a/detections/application/splunk_dos_using_malformed_saml_request.yml b/detections/application/splunk_dos_using_malformed_saml_request.yml index 88527398dc..89daaba839 100644 --- a/detections/application/splunk_dos_using_malformed_saml_request.yml +++ b/detections/application/splunk_dos_using_malformed_saml_request.yml @@ -5,8 +5,7 @@ date: '2023-09-05' author: Rod Soto status: production type: Hunting -data_source: -- splunkd.log +data_source: [] description: In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language SAML request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang. search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr splunk_server event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`' how_to_implement: To run this search, you must have access to the _internal index. diff --git a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml index fb9e6baef2..710ac51757 100644 --- a/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml +++ b/detections/application/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -5,8 +5,7 @@ date: '2023-09-05' author: Rod Soto status: production type: Hunting -data_source: -- web_access.log +data_source: [] description: In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the app search table web endpoint, which presents as the Create Table View page in Splunk Web. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk platform instance. A JavaScript file within this web endpoint does not properly validate input which lets an attacker insert a payload into a function. search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time) as firstTime max(_time) as lastTime by clientip status user view root uri_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' how_to_implement: Need access to the internal indexes. diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml index f706a7c9eb..8f12392afd 100644 --- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml +++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml @@ -32,10 +32,12 @@ tags: - CVE-2023-22939 - CVE-2023-22940 - CVE-2023-40598 + - CVE-2023-40598 impact: 50 message: Use of risky splunk command $splunk_risky_command$ detected by $user$ mitre_attack_id: - T1548 + - T1202 observable: - name: user type: User @@ -67,6 +69,12 @@ tests: - name: True Positive Test runshellscript abuse attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +- name: True Positive Test Additional runshellscript abuse + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log source: audittrail sourcetype: audittrail custom_index: _audit \ No newline at end of file diff --git a/lookups/splunk_risky_command.yml b/lookups/splunk_risky_command.yml index f02dcdc19a..a9b296dd68 100644 --- a/lookups/splunk_risky_command.yml +++ b/lookups/splunk_risky_command.yml @@ -1,5 +1,5 @@ description: A list of Risky Splunk Command that are candidates for abuse -filename: splunk_risky_command_20230830.csv +filename: splunk_risky_command_20231003.csv name: splunk_risky_command default_match: 'false' match_type: WILDCARD(splunk_risky_command) diff --git a/lookups/splunk_risky_command_20230830.csv b/lookups/splunk_risky_command_20231003.csv similarity index 80% rename from lookups/splunk_risky_command_20230830.csv rename to lookups/splunk_risky_command_20231003.csv index b0acb94c8e..81fab43d21 100644 --- a/lookups/splunk_risky_command_20230830.csv +++ b/lookups/splunk_risky_command_20231003.csv @@ -1,12 +1,14 @@ "splunk_risky_command","description","vulnerable_versions","CVE","other_metadata" -"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931","" -"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934","" -"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936","" -"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939","" -"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" -"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" -"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" -"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" -"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940","" -"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935","" -"*| *runshellscript* """"*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards","<8.1.14, <8.2.12, <9.0.6, <9.1.1","CVE-2023-40598","" +"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931", +"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934", +"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936", +"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939", +"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", +"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", +"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", +"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", +"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940", +"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935", +"*| *runshellscript* """"*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards; +runshellscript may be abused to exploit legacy internal functions in external lookups leading to arbitrary code execution","<8.1.14, <8.2.12, <9.0.6, <9.1.1; +<8.2.12, <9.0.6, <9.1.1","CVE-2023-40598", From f6dc49e1d3d69f3abc242ad1c641c31e308e7744 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 28 Sep 2023 16:18:50 -0700 Subject: [PATCH 63/89] add another filter so that we do not flag scripts running out of c: --- .../splunk_absolute_path_traversal_using_runshellscript.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index df8e1684c8..3bf5230c83 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -17,6 +17,7 @@ search: > | where runshellscript_args_count = 10 | eval interpreter=mvindex(array_indices,0) | eval targetScript=mvindex(array_indices,1) + | eval targetScript != "*C:*" | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter targetScript | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_absolute_path_traversal_using_runshellscript_filter` From 56abb4064723f2a9a4d56b040b1096af5465ac0f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 29 Sep 2023 13:19:47 -0700 Subject: [PATCH 64/89] More observable fixes, including renaming fields in searchers. --- detections/endpoint/net_profiler_uac_bypass.yml | 2 +- .../network_share_discovery_via_dir_command.yml | 3 ++- detections/endpoint/powershell_4104_hunting.yml | 11 ++++++----- ...lgroup_discovery_with_script_block_logging.yml | 10 ++++++---- .../process_deleting_its_process_file_path.yml | 4 ++-- ...very_with_env_vars_powershell_script_block.yml | 15 +++++++++++---- ...n_layer_protocol_rms_radmin_tool_namedpipe.yml | 7 ++++--- ...ripting_interpreter_hunting_path_traversal.yml | 2 +- .../windows_identify_protocol_handlers.yml | 2 +- .../windows_linked_policies_in_adsi_discovery.yml | 10 ++++++---- detections/endpoint/windows_nirsoft_utilities.yml | 2 +- ...windows_non_system_account_targeting_lsass.yml | 7 ++++--- ...ows_raw_access_to_master_boot_record_drive.yml | 5 +++-- ...dows_root_domain_linked_policies_discovery.yml | 13 ++++++++----- .../endpoint/windows_service_stop_win_updates.yml | 5 +++-- ...of_invalid_users_failed_to_auth_using_ntlm.yml | 10 ++++++---- .../endpoint/windows_wmi_impersonate_token.yml | 4 ++-- 17 files changed, 67 insertions(+), 45 deletions(-) diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index 0416cdfd38..f732b50f99 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -39,7 +39,7 @@ tags: - T1548 observable: - name: dest - type: Hostname + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index 89b49c88d7..2eeefdcb1a 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -15,6 +15,7 @@ description: The following analytic identifies object access on Windows administ this behavior to try to infect other machines in the infected network. search: '`wineventlog_security` EventCode=5140 ShareName IN("\\\\*\\ADMIN$","\\\\*\\C$","*\\\\*\\IPC$") AccessMask= 0x1 | stats min(_time) as firstTime max(_time) as lastTime count by ShareName IpAddress ObjectType SubjectUserName SubjectDomainName IpPort AccessMask Computer + | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_share_discovery_via_dir_command_filter`' @@ -39,7 +40,7 @@ tags: mitre_attack_id: - T1135 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 5bcfe78032..308bea7338 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -39,7 +39,8 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get | stats values(Score) by UserID, Computer, DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, - invokecmd, base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`' + invokecmd, base64, get, suspcmdlet, suspkeywrd | rename Computer as dest, UserID as user + | `powershell_4104_hunting_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -63,17 +64,17 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: Powershell was identified on endpoint $Computer$ by user $UserID$ executing suspicious commands. + message: Powershell was identified on endpoint $host$ by user $user$ executing suspicious commands. mitre_attack_id: - T1059 - T1059.001 observable: - - name: UserID + - name: user type: User role: - Victim - - name: Computer - type: Hostname + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index d6351797cf..4441d860a5 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -22,7 +22,9 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + ScriptBlockText | rename Computer as dest, UserID as user + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -41,16 +43,16 @@ tags: asset_type: Endpoint confidence: 50 impact: 30 - message: Local group discovery on $Computer$ by $UserID$. + message: Local group discovery on endpoint $dest$ by user $user$. mitre_attack_id: - T1069 - T1069.001 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim - - name: UserID + - name: user type: User role: - Victim diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 97f37ae181..10c7d047c7 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -42,12 +42,12 @@ tags: confidence: 100 impact: 60 message: A process $Image$ tries to delete its process path in commandline $CommandLine$ - as part of defense evasion in host $dest$ + as part of defense evasion in host $dest$ by user $user$ mitre_attack_id: - T1070 observable: - name: dest - type: Hostname + type: Endpoint role: - Victim - name: user diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 245ee554b9..30329070ac 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -14,8 +14,11 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*$env:UserName*" OR ScriptBlockText = "*[System.Environment]::UserName*") | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`' + as lastTime by EventCode ScriptBlockText Computer user_id + | rename Computer as dest, user_id as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `user_discovery_with_env_vars_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -29,14 +32,18 @@ tags: asset_type: Endpoint confidence: 50 impact: 30 - message: System user discovery on $Computer$ + message: System user discovery on endpoint $dest$ by user $user$ mitre_attack_id: - T1033 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim + - name: user + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml index a56e648ad4..081d51ad6e 100644 --- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml +++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml @@ -16,8 +16,9 @@ description: The following analytic identifies the use of default or publicly kn data_source: [] search: '`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") - | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType - ProcessId PipeName dest UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | stats min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessId PipeName dest UserID + | rename UserID as user + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -34,7 +35,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: possible RMS admin tool named pipe was created in $Computer$ + message: possible RMS admin tool named pipe was created in endpoint $dest$ mitre_attack_id: - T1071 observable: diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index 7488e771d8..2d5a54ea7d 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -50,7 +50,7 @@ tags: - T1059 observable: - name: dest - type: Hostname + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index 544251cf40..b09b6d20c0 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -57,7 +57,7 @@ tags: role: - Victim - name: dest - type: Hostname + type: Endpoint role: - Victim - name: parent_process_name diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index 29bee5ec15..1d870fb407 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -14,7 +14,9 @@ data_source: search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Computer user_id + | rename Computer as dest, user_id as user + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -31,13 +33,13 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: powershell process having commandline $ScriptBlockText$ for user enumeration on $Computer$ + message: Windows PowerShell [Adsisearcher] was used user enumeration on $user$ mitre_attack_id: - T1087.002 - T1087 observable: - - name: Computer - type: Hostname + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 136a4d60cc..16da2d053d 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -48,7 +48,7 @@ tags: role: - Victim - name: dest - type: Hostname + type: Endpoint role: - Victim - name: parent_process_name diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 888d0fe315..17646c3e74 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -14,8 +14,9 @@ data_source: - Sysmon Event ID 1 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, parent_process_path ,parent_process_id, TargetImage, - GrantedAccess, SourceUser, TargetUser | rename TargetUser - as user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + GrantedAccess, SourceUser, TargetUser + | rename TargetUser as user + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -46,7 +47,7 @@ tags: role: - Victim - name: dest - type: Hostname + type: Endpoint role: - Victim - name: parent_process_path diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 0eaf79518a..b39af95943 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -15,6 +15,7 @@ data_source: search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest Image Device ProcessGuid ProcessId EventDescription EventCode + | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and @@ -40,13 +41,13 @@ tags: asset_type: Endpoint confidence: 100 impact: 90 - message: process accessing MBR $device$ on $Computer$ + message: process accessing MBR $device$ on $dest$ mitre_attack_id: - T1561.002 - T1561 observable: - name: dest - type: Hostname + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index 3d17582330..a1126b491e 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -13,8 +13,11 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*" | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_root_domain_linked_policies_discovery_filter`' + max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | + | rename Computer as dest, user_id as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_root_domain_linked_policies_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -30,13 +33,13 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: powershell process having commandline $ScriptBlockText$ for user enumeration on $Computer$ + message: Windows PowerShell [Adsisearcher] was used user enumeration on endpoint $dest$ mitre_attack_id: - T1087.002 - T1087 observable: - - name: Computer - type: Hostname + - name: dest + type: Endpoint role: - Victim product: diff --git a/detections/endpoint/windows_service_stop_win_updates.yml b/detections/endpoint/windows_service_stop_win_updates.yml index 7782d42eac..52fac9b2c0 100644 --- a/detections/endpoint/windows_service_stop_win_updates.yml +++ b/detections/endpoint/windows_service_stop_win_updates.yml @@ -15,6 +15,7 @@ search: '`wineventlog_system` EventCode=7040 (service_name IN ("Update Orchestrator Service for Windows Update", "WaaSMedicSvc", "Windows Update") OR param1 IN ("UsoSvc", "WaaSMedicSvc", "wuauserv")) AND (param3=disabled OR start_mode = disabled) | stats count min(_time) as firstTime max(_time) as lastTime by Computer Error_Code service_name start_mode param1 param2 param3 param4 + | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_win_updates_filter`' @@ -30,11 +31,11 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: Windows update services $service_name$ was being disabled on $Computer$ + message: Windows update services $service_name$ was being disabled on $dest$ mitre_attack_id: - T1489 observable: - - name: Computer + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml index 89c7842f63..672f37230a 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -43,7 +43,9 @@ search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc000 as tried_accounts by _time, Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`' + | search isOutlier=1 + | rename Workstation as src + |`windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`' status: production tags: analytic_story: @@ -52,15 +54,15 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: Potential NTLM based password spraying attack from $Workstation$ + message: Potential NTLM based password spraying attack from $src$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Workstation + - name: src + type: Endpoint role: - Attacker - type: Endpoint product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 04e952eebb..c550f23c1c 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -35,12 +35,12 @@ tags: confidence: 50 impact: 50 message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ - to $TargetImage$ process in $Computer$ + to $TargetImage$ process in $dest$ mitre_attack_id: - T1047 observable: - name: dest - type: Hostname + type: Endpoint role: - Victim product: From 31bc1a0820d7e008647c8978a142b76f98948722 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 29 Sep 2023 14:17:05 -0700 Subject: [PATCH 65/89] Minor search fixes for observables --- .../windows_raw_access_to_master_boot_record_drive.yml | 4 ++-- .../windows_root_domain_linked_policies_discovery.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index b39af95943..e9dcfe8fc7 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 9 search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as - lastTime by dest Image Device ProcessGuid ProcessId EventDescription EventCode + lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -41,7 +41,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 90 - message: process accessing MBR $device$ on $dest$ + message: process accessing MBR $Device$ on $dest$ mitre_attack_id: - T1561.002 - T1561 diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index a1126b491e..e637e6c149 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -13,7 +13,7 @@ data_source: - Powershell 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*" | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | + max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | rename Computer as dest, user_id as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 17ca5971d3db574edb9546138636f5797cbff7ee Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sun, 1 Oct 2023 09:39:59 -0600 Subject: [PATCH 66/89] WS_FTP --- .../detect_webshell_exploit_behavior.yml | 1 + detections/endpoint/w3wp_spawning_shell.yml | 1 + ...nents_get_webglobalmodule_module_query.yml | 1 + ...ws_ftp_server_critical_vulnerabilities.yml | 22 +++++++++++++++++++ 4 files changed, 25 insertions(+) create mode 100644 stories/ws_ftp_server_critical_vulnerabilities.yml diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml index 67398cc24f..72d173bf56 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -49,6 +49,7 @@ tags: - CISA AA22-264A - Citrix ShareFile RCE CVE-2023-24489 - Flax Typhoon + - WS_FTP Server Critical Vulnerabilities asset_type: Endpoint confidence: 80 impact: 100 diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index d30d991020..425a912372 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -49,6 +49,7 @@ tags: - BlackByte Ransomware - CISA AA22-264A - Flax Typhoon + - WS_FTP Server Critical Vulnerabilities asset_type: Endpoint confidence: 80 cve: diff --git a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml index 0168c2dc4a..827062deb5 100644 --- a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml +++ b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml @@ -23,6 +23,7 @@ references: tags: analytic_story: - IIS Components + - WS_FTP Server Critical Vulnerabilities asset_type: Endpoint confidence: 10 impact: 10 diff --git a/stories/ws_ftp_server_critical_vulnerabilities.yml b/stories/ws_ftp_server_critical_vulnerabilities.yml new file mode 100644 index 0000000000..92b6214370 --- /dev/null +++ b/stories/ws_ftp_server_critical_vulnerabilities.yml @@ -0,0 +1,22 @@ +name: WS_FTP Server Critical Vulnerabilities +id: 60466291-3ab4-452b-9c11-456aa2dc7293 +version: 1 +date: '2023-10-01' +author: Michael Haag, Splunk +description: A critical security advisory was released by Progress Software on September 27, 2023, concerning multiple vulnerabilities in WS_FTP Server, a widely-used secure file transfer solution. The two critical vulnerabilities are CVE-2023-40044, a .NET deserialization flaw, and CVE-2023-42657, a directory traversal vulnerability. Rapid7 has observed active exploitation of these vulnerabilities. Affected versions are prior to 8.7.4 and 8.8.2. Immediate action is advised - upgrade to WS_FTP Server version 8.8.2. For those unable to update, disabling the Ad Hoc Transfer module is suggested as a temporary measure. This comes in the wake of increased scrutiny following the Cl0p ransomware attack on MOVEit Transfer in May 2023. +narrative: Two critical vulnerabilities have been identified in WS_FTP Server, a widely-used secure file transfer solution. The first, CVE-2023-40044, is a .NET deserialization flaw that targets the Ad Hoc Transfer module of WS_FTP Server versions earlier than 8.7.4 and 8.8.2. This flaw allows an attacker to execute arbitrary commands on the server's operating system without needing authentication. The second vulnerability, CVE-2023-42657, is a directory traversal flaw that allows attackers to perform unauthorized file operations outside of their authorized WS_FTP folder. In severe cases, the attacker could escape the WS_FTP Server file structure and perform operations on the underlying operating system. Both vulnerabilities have been observed being exploited in the wild and immediate action for mitigation is strongly advised. Updating to WS_FTP Server version 8.8.2 is recommended. For those unable to update, disabling the Ad Hoc Transfer module is suggested as a temporary measure. +references: +- https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044 +- https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 +- https://www.cve.org/CVERecord?id=CVE-2023-40044 +- https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/ +- https://www.splunk.com/en_us/blog/security/fantastic-iis-modules-and-how-to-find-them.html +tags: + analytic_story: WS_FTP Server Critical Vulnerabilities + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From a3d1907490afd252becf50cf214b5012227148cb Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sun, 1 Oct 2023 09:42:31 -0600 Subject: [PATCH 67/89] fixes --- detections/endpoint/detect_webshell_exploit_behavior.yml | 2 +- detections/endpoint/w3wp_spawning_shell.yml | 2 +- ...indows_iis_components_get_webglobalmodule_module_query.yml | 2 +- stories/ws_ftp_server_critical_vulnerabilities.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml index 72d173bf56..b436fd0dd3 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/detect_webshell_exploit_behavior.yml @@ -49,7 +49,7 @@ tags: - CISA AA22-264A - Citrix ShareFile RCE CVE-2023-24489 - Flax Typhoon - - WS_FTP Server Critical Vulnerabilities + - WS FTP Server Critical Vulnerabilities asset_type: Endpoint confidence: 80 impact: 100 diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 425a912372..dd71bf1238 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -49,7 +49,7 @@ tags: - BlackByte Ransomware - CISA AA22-264A - Flax Typhoon - - WS_FTP Server Critical Vulnerabilities + - WS FTP Server Critical Vulnerabilities asset_type: Endpoint confidence: 80 cve: diff --git a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml index 827062deb5..9a4730c309 100644 --- a/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml +++ b/detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml @@ -23,7 +23,7 @@ references: tags: analytic_story: - IIS Components - - WS_FTP Server Critical Vulnerabilities + - WS FTP Server Critical Vulnerabilities asset_type: Endpoint confidence: 10 impact: 10 diff --git a/stories/ws_ftp_server_critical_vulnerabilities.yml b/stories/ws_ftp_server_critical_vulnerabilities.yml index 92b6214370..05a258503c 100644 --- a/stories/ws_ftp_server_critical_vulnerabilities.yml +++ b/stories/ws_ftp_server_critical_vulnerabilities.yml @@ -1,4 +1,4 @@ -name: WS_FTP Server Critical Vulnerabilities +name: WS FTP Server Critical Vulnerabilities id: 60466291-3ab4-452b-9c11-456aa2dc7293 version: 1 date: '2023-10-01' @@ -12,7 +12,7 @@ references: - https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/ - https://www.splunk.com/en_us/blog/security/fantastic-iis-modules-and-how-to-find-them.html tags: - analytic_story: WS_FTP Server Critical Vulnerabilities + analytic_story: WS FTP Server Critical Vulnerabilities category: - Adversary Tactics product: From 85ec2974bbfa57029ab366bb328e5666aba272a1 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sun, 1 Oct 2023 10:18:46 -0600 Subject: [PATCH 68/89] Create ws_ftp_remote_code_execution.yml --- .../web/ws_ftp_remote_code_execution.yml | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 detections/web/ws_ftp_remote_code_execution.yml diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml new file mode 100644 index 0000000000..8b4bec62a9 --- /dev/null +++ b/detections/web/ws_ftp_remote_code_execution.yml @@ -0,0 +1,62 @@ +name: WS FTP Remote Code Execution +id: b84e8f39-4e7b-4d4f-9e7c-fcd29a227845 +version: 1 +date: '2023-10-01' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: [] +description: 'The following analytic is designed to detect a Remote Code Execution (RCE) vulnerability (CVE-2023-40044) in WS_FTP, a managed file transfer software by Progress. The search specifically looks for HTTP requests to the "/AHT/AhtApiService.asmx/AuthUser" URL with a status of 200, which could indicate an exploitation attempt.' +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("/AHT/AhtApiService.asmx/AuthUser") Web.status=200 + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `ws_ftp_remote_code_execution_filter`' +how_to_implement: The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source. +known_false_positives: If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment. +references: +- https://github.com/projectdiscovery/nuclei-templates/pull/8296/files +- https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044 +tags: + cve: + - CVE-2023-40044 + analytic_story: + - WS FTP Server Critical Vulnerabilities + asset_type: Web server + atomic_guid: [] + confidence: 80 + impact: 90 + message: Potential WS FTP Remote Code Execution detected against URL $url$ on $dest$ + mitre_attack_id: + - T1190 + observable: + - name: url + type: string + role: + - Uniform Resource Locator + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 72 + required_fields: + - Web.http_user_agent + - Web.status + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - sourcetype + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/ws_ftp/wsftpweb.log + source: suricata + sourcetype: suricata From 63c248fe02ce0c20b2daf8b27df189f12ef88442 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sun, 1 Oct 2023 10:23:12 -0600 Subject: [PATCH 69/89] Update ws_ftp_remote_code_execution.yml --- detections/web/ws_ftp_remote_code_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml index 8b4bec62a9..b30f07ae53 100644 --- a/detections/web/ws_ftp_remote_code_execution.yml +++ b/detections/web/ws_ftp_remote_code_execution.yml @@ -32,7 +32,7 @@ tags: - T1190 observable: - name: url - type: string + type: URL String role: - Uniform Resource Locator - name: dest From 5921fc0679731aa0f3a9781f5face6c3bf2dd636 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sun, 1 Oct 2023 10:25:32 -0600 Subject: [PATCH 70/89] fix --- detections/web/ws_ftp_remote_code_execution.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml index b30f07ae53..b0bfc4bf14 100644 --- a/detections/web/ws_ftp_remote_code_execution.yml +++ b/detections/web/ws_ftp_remote_code_execution.yml @@ -34,11 +34,11 @@ tags: - name: url type: URL String role: - - Uniform Resource Locator - - name: dest - type: Hostname - role: - - Victim + - Other + - name: dest + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security From 36c15130f6eac24cc6137f128a83511661adfb99 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Sun, 1 Oct 2023 10:59:09 -0600 Subject: [PATCH 71/89] JetBrains TeamCity RCE --- .../web/jetbrains_teamcity_rce_attempt.yml | 63 +++++++++++++++++++ ...jetbrains_teamcity_unauthenticated_rce.yml | 22 +++++++ 2 files changed, 85 insertions(+) create mode 100644 detections/web/jetbrains_teamcity_rce_attempt.yml create mode 100644 stories/jetbrains_teamcity_unauthenticated_rce.yml diff --git a/detections/web/jetbrains_teamcity_rce_attempt.yml b/detections/web/jetbrains_teamcity_rce_attempt.yml new file mode 100644 index 0000000000..c9813776dd --- /dev/null +++ b/detections/web/jetbrains_teamcity_rce_attempt.yml @@ -0,0 +1,63 @@ +name: JetBrains TeamCity RCE Attempt +id: 89a58e5f-1365-4793-b45c-770abbb32b6c +version: 1 +date: '2023-10-01' +author: Michael Haag, Splunk +status: production +type: TTP +data_source: [] +description: 'The following analytic is designed to detect attempts to exploit the CVE-2023-42793 vulnerability in TeamCity On-Premises. It focuses on identifying suspicious POST requests to /app/rest/users/id:1/tokens/RPC2, which is the initial point of exploitation. This could indicate an unauthenticated attacker trying to gain administrative access through Remote Code Execution (RCE).' +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("/app/rest/users/id:1/tokens/RPC2*") Web.status=200 Web.http_method=POST + by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `jetbrains_teamcity_rce_attempt_filter`' +how_to_implement: The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source. +known_false_positives: If TeamCity is not in use, this analytic will not return results. Monitor and tune for your environment. +references: +- https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/ +- https://www.sonarsource.com/blog/teamcity-vulnerability/ +- https://github.com/rapid7/metasploit-framework/pull/18408 +- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis +tags: + cve: + - CVE-2023-42793 + analytic_story: + - JetBrains TeamCity Unauthenticated RCE + asset_type: Web server + atomic_guid: [] + confidence: 90 + impact: 90 + message: Potential JetBrains TeamCity RCE Attempt detected against URL $url$ on $dest$. + mitre_attack_id: + - T1190 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: url + type: URL String + role: + - Other + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 81 + required_fields: + - Web.http_user_agent + - Web.status + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/jetbrains/teamcity.log + source: suricata + sourcetype: suricata diff --git a/stories/jetbrains_teamcity_unauthenticated_rce.yml b/stories/jetbrains_teamcity_unauthenticated_rce.yml new file mode 100644 index 0000000000..aac17938b4 --- /dev/null +++ b/stories/jetbrains_teamcity_unauthenticated_rce.yml @@ -0,0 +1,22 @@ +name: JetBrains TeamCity Unauthenticated RCE +id: 7ef2d230-9dbb-4d13-9263-a7d8c3aad9bf +version: 1 +date: '2023-10-01' +author: Michael Haag, Splunk +description: A critical security vulnerability, CVE-2023-42793, has been discovered affecting all versions of TeamCity On-Premises up to 2023.05.3. This vulnerability allows unauthenticated attackers to execute remote code and gain administrative control of the TeamCity server, posing a significant risk for supply chain attacks. Although the issue has been fixed in version 2023.05.4, servers running older versions remain at risk. A security patch plugin has been released for immediate mitigation, applicable to TeamCity versions 8.0 and above. Organizations are strongly advised to update to the fixed version or apply the security patch, especially if their TeamCity server is publicly accessible. No impact has been reported on TeamCity Cloud as it has been upgraded to the secure version. +narrative: The CVE-2023-42793 vulnerability in TeamCity On-Premises allows an unauthenticated attacker to bypass authentication and gain administrative access through Remote Code Execution (RCE). Specifically, the attacker can send a malicious POST request to /app/rest/users/id:1/tokens/RPC2 to create an administrative token. Once the token is obtained, the attacker has the ability to perform various unauthorized activities, including creating new admin users and executing arbitrary shell commands on the server. \ + For Splunk Security Content, the focus should be on identifying suspicious POST requests to /app/rest/users/id:1/tokens/RPC2 and other affected API endpoints, as this is the initial point of exploitation. Monitoring logs for changes to the internal.properties file or the creation of new admin users could also provide crucial indicators of compromise. Furthermore, Splunk can be configured to alert on multiple failed login attempts followed by a successful login from the same IP, which could indicate exploitation attempts. +references: +- https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/ +- https://www.sonarsource.com/blog/teamcity-vulnerability/ +- https://github.com/rapid7/metasploit-framework/pull/18408 +- https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis +tags: + analytic_story: JetBrains TeamCity Unauthenticated RCE + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 34252303f2f1c92d4af2206769e2d1a64ef1be1a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 2 Oct 2023 08:52:40 -0700 Subject: [PATCH 72/89] Adding POST --- detections/web/ws_ftp_remote_code_execution.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml index b0bfc4bf14..ba2f5b4d42 100644 --- a/detections/web/ws_ftp_remote_code_execution.yml +++ b/detections/web/ws_ftp_remote_code_execution.yml @@ -8,7 +8,7 @@ type: TTP data_source: [] description: 'The following analytic is designed to detect a Remote Code Execution (RCE) vulnerability (CVE-2023-40044) in WS_FTP, a managed file transfer software by Progress. The search specifically looks for HTTP requests to the "/AHT/AhtApiService.asmx/AuthUser" URL with a status of 200, which could indicate an exploitation attempt.' search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("/AHT/AhtApiService.asmx/AuthUser") Web.status=200 + as lastTime from datamodel=Web where Web.url IN ("/AHT/AhtApiService.asmx/AuthUser") Web.status=200 Web.http_method=POST by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` From ca1758dee7eb8bf9321b6825d3fc57aa9153a21b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 2 Oct 2023 08:55:43 -0700 Subject: [PATCH 73/89] adding Attacker obs --- detections/web/jetbrains_teamcity_rce_attempt.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/detections/web/jetbrains_teamcity_rce_attempt.yml b/detections/web/jetbrains_teamcity_rce_attempt.yml index c9813776dd..19d114fe18 100644 --- a/detections/web/jetbrains_teamcity_rce_attempt.yml +++ b/detections/web/jetbrains_teamcity_rce_attempt.yml @@ -41,6 +41,10 @@ tags: type: URL String role: - Other + - name: src + type: IP Address + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security From f3540a2da7c0b0e94f77f8269d0b5343e5ab435e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 2 Oct 2023 08:57:56 -0700 Subject: [PATCH 74/89] Update message --- detections/web/ws_ftp_remote_code_execution.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml index ba2f5b4d42..e804743b1a 100644 --- a/detections/web/ws_ftp_remote_code_execution.yml +++ b/detections/web/ws_ftp_remote_code_execution.yml @@ -27,7 +27,7 @@ tags: atomic_guid: [] confidence: 80 impact: 90 - message: Potential WS FTP Remote Code Execution detected against URL $url$ on $dest$ + message: Potential WS FTP Remote Code Execution detected against URL $url$ on $dest$ from $src$ mitre_attack_id: - T1190 observable: @@ -38,7 +38,11 @@ tags: - name: dest type: Hostname role: - - Victim + - Victim + - name: src + type: IP Address + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security From 588ef14f0cc66e2694aa592bc01cc36de5990c8d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 11:03:24 -0700 Subject: [PATCH 75/89] Added fillnull to improve detection accuracy for all logs. --- .../splunk_risky_command_abuse_disclosed_february_2023.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml index 8f12392afd..0091e319d3 100644 --- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml +++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml @@ -9,7 +9,7 @@ description: This search looks for a variety of high-risk commands throughout a number of different Splunk Vulnerability Disclosures. Please refer to the following URL for additional information on these disclosures - https://advisory.splunk.com data_source: [] -search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity +search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command From de281dcdb6693858b2b66f421e9541c83d80509b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 11:36:50 -0700 Subject: [PATCH 76/89] First version of new detection for testing --- ...unk_rce_via_serialized_session_payload.yml | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 detections/application/splunk_rce_via_serialized_session_payload.yml diff --git a/detections/application/splunk_rce_via_serialized_session_payload.yml b/detections/application/splunk_rce_via_serialized_session_payload.yml new file mode 100644 index 0000000000..f533337037 --- /dev/null +++ b/detections/application/splunk_rce_via_serialized_session_payload.yml @@ -0,0 +1,58 @@ +name: Splunk RCE via Serialized Session Payload +id: d1d8fda6-874a-400f-82cf-dcbb59d8e4db +version: 1 +date: '2023-10-02' +author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk +status: production +type: Hunting +description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that + they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code. The exploit requires the use + of the 'collect' SPL command which writes a file within the Splunk Enterprise installation. The attacker can then use this file to + submit a serialized payload that can result in execution of code within the payload. Please refer to the + following URL for additional information on these disclosures - https://advisory.splunk.com +data_source: [] +search: '`audit_searches` | `splunk_rce_via_serialized_session_payload_filter`' +how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel. +known_false_positives: There are numerous many uses of the 'makeresults' and 'collect' SPL commands. + Please evaluate the results of this search for potential abuse. +references: +- https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + confidence: 50 + cve: + - CVE-2023-40595 + impact: 50 + message: Potential abuse of the 'collect' SPL command against $splunk_server$ by detected by $user$ + mitre_attack_id: + - T1190 + observable: + - name: user + type: User + role: + - Attacker + - name: splunk_server + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - search + - info + - user + - search_type + - count + risk_score: 25 + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_rce_via_serialized_session_payload_audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit From a00fce83dbc392cdd8f3c072eee51013e6a1decc Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 11:49:57 -0700 Subject: [PATCH 77/89] Update to new search after dynamic testing and refinement. --- .../splunk_rce_via_serialized_session_payload.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_rce_via_serialized_session_payload.yml b/detections/application/splunk_rce_via_serialized_session_payload.yml index f533337037..79ca04c2d7 100644 --- a/detections/application/splunk_rce_via_serialized_session_payload.yml +++ b/detections/application/splunk_rce_via_serialized_session_payload.yml @@ -11,8 +11,12 @@ description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, submit a serialized payload that can result in execution of code within the payload. Please refer to the following URL for additional information on these disclosures - https://advisory.splunk.com data_source: [] -search: '`audit_searches` | `splunk_rce_via_serialized_session_payload_filter`' -how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel. +search: '`audit_searches` source=audittrail file=* (search="*makeresults*" AND search="*collect*") + | stats count min(_time) as firstTime max(_time) as lastTime by action file user splunk_server search + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_rce_via_serialized_session_payload_filter`' +how_to_implement: Requires access to the _audit index. known_false_positives: There are numerous many uses of the 'makeresults' and 'collect' SPL commands. Please evaluate the results of this search for potential abuse. references: From b16a497093ac68765e082d25d57778202a8a8f5b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 11:54:06 -0700 Subject: [PATCH 78/89] remove source= from search --- .../application/splunk_rce_via_serialized_session_payload.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_rce_via_serialized_session_payload.yml b/detections/application/splunk_rce_via_serialized_session_payload.yml index 79ca04c2d7..f9e1e6e9a1 100644 --- a/detections/application/splunk_rce_via_serialized_session_payload.yml +++ b/detections/application/splunk_rce_via_serialized_session_payload.yml @@ -11,7 +11,7 @@ description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, submit a serialized payload that can result in execution of code within the payload. Please refer to the following URL for additional information on these disclosures - https://advisory.splunk.com data_source: [] -search: '`audit_searches` source=audittrail file=* (search="*makeresults*" AND search="*collect*") +search: '`audit_searches` file=* (search="*makeresults*" AND search="*collect*") | stats count min(_time) as firstTime max(_time) as lastTime by action file user splunk_server search | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 96c931eda93105f1c8acca55c8861ac59eace5f4 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 12:45:09 -0700 Subject: [PATCH 79/89] use macro instead of using index and sourcetype directly. --- .../splunk_absolute_path_traversal_using_runshellscript.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml index 3bf5230c83..96e8de1e72 100644 --- a/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml +++ b/detections/application/splunk_absolute_path_traversal_using_runshellscript.yml @@ -8,7 +8,7 @@ type: Hunting data_source: [] description: In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk. search: > - index=_internal sourcetype=splunk_python *runshellscript* + `splunk_python` *runshellscript* | eval log_split=split(_raw, "runshellscript: ") | eval array_raw = mvindex(log_split,1) | eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","") From d57b3f1fcf848c206c1cd795a64e6057d97dcd1e Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 12:56:00 -0700 Subject: [PATCH 80/89] properly format times in risky command search --- .../splunk_risky_command_abuse_disclosed_february_2023.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml index 0091e319d3..5547eb6fb3 100644 --- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml +++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml @@ -14,7 +14,10 @@ search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions - CVE other_metadata | where splunk_risky_command != "false" | `splunk_risky_command_abuse_disclosed_february_2023_filter`' + CVE other_metadata | where splunk_risky_command != "false" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_risky_command_abuse_disclosed_february_2023_filter`' how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel. known_false_positives: This search encompasses many commands. references: From fd7f9cfbf38255056b7fbdf4f0224cc2e218de9f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 2 Oct 2023 16:18:51 -0700 Subject: [PATCH 81/89] new_ssa_detection --- ...ervices_lolbas_execution_process_spawn.yml | 102 +++++++++++++ ...ervices_lolbas_execution_process_spawn.yml | 139 ++++++++++++++++++ ...ervices_lolbas_execution_process_spawn.yml | 128 ++++++++++++++++ 3 files changed, 369 insertions(+) create mode 100644 dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml create mode 100644 dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml create mode 100644 ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml diff --git a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..daa5c65cd7 --- /dev/null +++ b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -0,0 +1,102 @@ +name: Services lolbas Execution Process Spawn +id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +version: 1 +date: '2023-10-02' +author: Bhavin Patel, Splunk +status: production +type: Anomaly +description: The following analytic identifies services.exe spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned as a child process of services.exe. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. +data_source: +- Windows Security 4688 +search: + selection1: + actor.process.file.name: services.exe + selection2: + process.file.name: + - Regsvcs.exe + - Ftp.exe + - OfflineScannerShell.exe + - Rasautou.exe + - Schtasks.exe + - Xwizard.exe + - Dllhost.exe + - Pnputil.exe + - Atbroker.exe + - Pcwrun.exe + - Ttdinject.exe + - Mshta.exe + - Bitsadmin.exe + - Certoc.exe + - Ieexec.exe + - Microsoft.Workflow.Compiler.exe + - Runscripthelper.exe + - Forfiles.exe + - Msbuild.exe + - Register-cimprovider.exe + - Tttracer.exe + - Ie4uinit.exe + - Bash.exe + - Hh.exe + - SettingSyncHost.exe + - Cmstp.exe + - Mmc.exe + - Stordiag.exe + - Scriptrunner.exe + - Odbcconf.exe + - Extexport.exe + - Msdt.exe + - WorkFolders.exe + - Diskshadow.exe + - Mavinject.exe + - Regasm.exe + - Gpscript.exe + - Rundll32.exe + - Regsvr32.exe + - Msiexec.exe + - Wuauclt.exe + - Presentationhost.exe + - Wmic.exe + - Runonce.exe + - Syncappvpublishingserver.exe + - Verclsid.exe + - Infdefaultinstall.exe + - Explorer.exe + - Installutil.exe + - Netsh.exe + - Wab.exe + - Dnscmd.exe + - At.exe + - Pcalua.exe + - Msconfig.exe + condition: (selection1 and selection2) +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: There are circumstances where the services application may legitimately execute and spawn a windows native binary to do an activity that is benign. +references: +- https://attack.mitre.org/techniques/T1543/003/ +- https://pentestlab.blog/2020/07/21/lateral-movement-services/ + +tags: + analytic_story: + - Suspicious Command-Line Executions + - Insider Threat + asset_type: Endpoint + confidence: 50 + impact: 70 + message: An instance of services.exe spawning $process_name$ was identified + on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event + that warrants investigating. + mitre_attack_id: + - T1543.003 + observable: [] + product: + - Splunk Behavioral Analytics + required_fields: [] + kill_chain_phases: + - Exploitation + risk_score: 35 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log + source: XMLWinEventLog:Security \ No newline at end of file diff --git a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..adb586b2d9 --- /dev/null +++ b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml @@ -0,0 +1,139 @@ +name: Services lolbas Execution Process Spawn +id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +version: 1 +status: production +description: The following analytic identifies services.exe spawning a LOLBAS execution + process. When adversaries execute code on remote endpoints abusing the Service Control + Manager and creating a remote malicious service, the executed command is spawned + as a child process of services.exe. The LOLBAS project documents Windows native + binaries that can be abused by threat actors to perform tasks like executing malicious + code. Looking for child processes of services.exe that are part of the LOLBAS project + can help defenders identify lateral movement activity. +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where actor_process_file_name="services.exe" + AND (process_file_name="Regsvcs.exe" OR process_file_name="Ftp.exe" OR process_file_name="OfflineScannerShell.exe" + OR process_file_name="Rasautou.exe" OR process_file_name="Schtasks.exe" OR process_file_name="Xwizard.exe" + OR process_file_name="Dllhost.exe" OR process_file_name="Pnputil.exe" OR process_file_name="Atbroker.exe" + OR process_file_name="Pcwrun.exe" OR process_file_name="Ttdinject.exe" OR process_file_name="Mshta.exe" + OR process_file_name="Bitsadmin.exe" OR process_file_name="Certoc.exe" OR process_file_name="Ieexec.exe" + OR process_file_name="Microsoft.Workflow.Compiler.exe" OR process_file_name="Runscripthelper.exe" + OR process_file_name="Forfiles.exe" OR process_file_name="Msbuild.exe" OR process_file_name="Register-cimprovider.exe" + OR process_file_name="Tttracer.exe" OR process_file_name="Ie4uinit.exe" OR process_file_name="Bash.exe" + OR process_file_name="Hh.exe" OR process_file_name="SettingSyncHost.exe" OR process_file_name="Cmstp.exe" + OR process_file_name="Mmc.exe" OR process_file_name="Stordiag.exe" OR process_file_name="Scriptrunner.exe" + OR process_file_name="Odbcconf.exe" OR process_file_name="Extexport.exe" OR process_file_name="Msdt.exe" + OR process_file_name="WorkFolders.exe" OR process_file_name="Diskshadow.exe" OR + process_file_name="Mavinject.exe" OR process_file_name="Regasm.exe" OR process_file_name="Gpscript.exe" + OR process_file_name="Rundll32.exe" OR process_file_name="Regsvr32.exe" OR process_file_name="Msiexec.exe" + OR process_file_name="Wuauclt.exe" OR process_file_name="Presentationhost.exe" OR + process_file_name="Wmic.exe" OR process_file_name="Runonce.exe" OR process_file_name="Syncappvpublishingserver.exe" + OR process_file_name="Verclsid.exe" OR process_file_name="Infdefaultinstall.exe" + OR process_file_name="Explorer.exe" OR process_file_name="Installutil.exe" OR process_file_name="Netsh.exe" + OR process_file_name="Wab.exe" OR process_file_name="Dnscmd.exe" OR process_file_name="At.exe" + OR process_file_name="Pcalua.exe" OR process_file_name="Msconfig.exe") + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, + message = "Services lolbas Execution Process Spawn has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Suspicious Command-Line Executions", "Insider Threat"], + class_name = "Detection Report", + confidence = 50, + confidence_id = 2, + duration = 0, + impact = 70, + impact_id = 4, + kill_chain = [], + nist = ["DE.AE"], + risk_level = "Low", + category_uid = 2, + class_uid = 102001, + risk_level_id = 1, + risk_score = 35, + severity_id = 0, + rule = {"name": "Services lolbas Execution Process Spawn", "uid": "fd40c537-53d0-4c28-9b7e-77cfd28a49c8", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the Processes node of the Endpoint + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: There are circumstances where the services application may + legitimately execute and spawn a windows native binary to do an activity that is + benign. +references: +- https://attack.mitre.org/techniques/T1543/003/ +- https://pentestlab.blog/2020/07/21/lateral-movement-services/ +tags: + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 35 + security_domain: endpoint + risk_severity: low + research_site_url: https://research.splunk.com/endpoint/fd40c537-53d0-4c28-9b7e-77cfd28a49c8/ + event_schema: ocsf + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest + annotations: + analytic_story: + - Suspicious Command-Line Executions + - Insider Threat + cis20: + - CIS 10 + kill_chain_phases: [] + mitre_attack_id: + - T1543.003 + nist: + - DE.AE +test: + name: Services lolbas Execution Process Spawn Unit Test + tests: + - name: Services lolbas Execution Process Spawn + attack_data: + - file_name: 4688_xml_windows_security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log + source: XMLWinEventLog:Security +runtime: SPL2 +internalVersion: 2 diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml new file mode 100644 index 0000000000..5f30419aa0 --- /dev/null +++ b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -0,0 +1,128 @@ +name: Services lolbas Execution Process Spawn +id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +version: 1 +date: '2023-10-02' +author: Bhavin Patel, Splunk +type: Anomaly +status: production +description: The following analytic identifies services.exe spawning a LOLBAS execution + process. When adversaries execute code on remote endpoints abusing the Service Control + Manager and creating a remote malicious service, the executed command is spawned + as a child process of services.exe. The LOLBAS project documents Windows native + binaries that can be abused by threat actors to perform tasks like executing malicious + code. Looking for child processes of services.exe that are part of the LOLBAS project + can help defenders identify lateral movement activity. +data_source: +- Windows Security 4688 +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where actor_process_file_name="services.exe" + AND (process_file_name="Regsvcs.exe" OR process_file_name="Ftp.exe" OR process_file_name="OfflineScannerShell.exe" + OR process_file_name="Rasautou.exe" OR process_file_name="Schtasks.exe" OR process_file_name="Xwizard.exe" + OR process_file_name="Dllhost.exe" OR process_file_name="Pnputil.exe" OR process_file_name="Atbroker.exe" + OR process_file_name="Pcwrun.exe" OR process_file_name="Ttdinject.exe" OR process_file_name="Mshta.exe" + OR process_file_name="Bitsadmin.exe" OR process_file_name="Certoc.exe" OR process_file_name="Ieexec.exe" + OR process_file_name="Microsoft.Workflow.Compiler.exe" OR process_file_name="Runscripthelper.exe" + OR process_file_name="Forfiles.exe" OR process_file_name="Msbuild.exe" OR process_file_name="Register-cimprovider.exe" + OR process_file_name="Tttracer.exe" OR process_file_name="Ie4uinit.exe" OR process_file_name="Bash.exe" + OR process_file_name="Hh.exe" OR process_file_name="SettingSyncHost.exe" OR process_file_name="Cmstp.exe" + OR process_file_name="Mmc.exe" OR process_file_name="Stordiag.exe" OR process_file_name="Scriptrunner.exe" + OR process_file_name="Odbcconf.exe" OR process_file_name="Extexport.exe" OR process_file_name="Msdt.exe" + OR process_file_name="WorkFolders.exe" OR process_file_name="Diskshadow.exe" OR + process_file_name="Mavinject.exe" OR process_file_name="Regasm.exe" OR process_file_name="Gpscript.exe" + OR process_file_name="Rundll32.exe" OR process_file_name="Regsvr32.exe" OR process_file_name="Msiexec.exe" + OR process_file_name="Wuauclt.exe" OR process_file_name="Presentationhost.exe" OR + process_file_name="Wmic.exe" OR process_file_name="Runonce.exe" OR process_file_name="Syncappvpublishingserver.exe" + OR process_file_name="Verclsid.exe" OR process_file_name="Infdefaultinstall.exe" + OR process_file_name="Explorer.exe" OR process_file_name="Installutil.exe" OR process_file_name="Netsh.exe" + OR process_file_name="Wab.exe" OR process_file_name="Dnscmd.exe" OR process_file_name="At.exe" + OR process_file_name="Pcalua.exe" OR process_file_name="Msconfig.exe") --finding_report--' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the Processes node of the Endpoint + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: There are circumstances where the services application may + legitimately execute and spawn a windows native binary to do an activity that is + benign. +references: +- https://attack.mitre.org/techniques/T1543/003/ +- https://pentestlab.blog/2020/07/21/lateral-movement-services/ +tags: + analytic_story: + - Suspicious Command-Line Executions + - Insider Threat + asset_type: Endpoint + confidence: 50 + impact: 70 + message: An instance of services.exe spawning $process_name$ was identified on endpoint + $dest_device_id$ by user $dest_user_id$, producing a suspicious event that warrants + investigating. + mitre_attack_id: + - T1543.003 + observable: + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File + - name: process.cmd_line + type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 35 + security_domain: endpoint + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log + source: XMLWinEventLog:Security From 95f836d4f6056d3cbbb9f7fc1d15c6e3b6fc390c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 16:42:39 -0700 Subject: [PATCH 82/89] Support for 'status: validation' to be used ONLY for BA Detections. If this is used with a non-ba detection, an exception will be generated. --- .../contentctl_core/application/factory/ba_factory.py | 2 +- .../contentctl_core/domain/entities/detection.py | 10 ++++++++++ .../contentctl_core/domain/entities/enums/enums.py | 1 + .../ssa___services_lolbas_execution_process_spawn.yml | 2 +- 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py b/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py index 04605b4ccf..c3cdb9d73a 100644 --- a/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py +++ b/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py @@ -99,7 +99,7 @@ class BAFactory(): - if detection.status == "production": + if detection.status in ["production","validation"]: self.output_dto.detections.append(detection) else: raise(Exception(f"Unsupported content type: [{type}]")) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 23a3dcdf15..52b95b0391 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -140,6 +140,16 @@ class Detection(BaseModel, SecurityContentObject): if len(values["name"]) > 67: raise ValueError("name is longer then 67 chars: " + values["name"]) return values + + @root_validator + def validation_for_ba_only(cls, values): + # Ensure that only a BA detection can have status: validation + if values["status"] == "validation": + if "ssa_" not in values["file_path"]: + raise ValueError(f"The following is NOT an ssa_ detection, but has 'status: {values['status']} which may ONLY be used for ssa_ detections:' {values['file_path']}") + else: + print(f"Got an ssa validation detection: {values['file_path']}") + return values @root_validator diff --git a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py index 5d4ac3de10..91e397a4d1 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py @@ -59,3 +59,4 @@ class DetectionStatus(enum.Enum): production = "production" deprecated = "deprecated" experimental = "experimental" + validation = "validation" diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml index 5f30419aa0..52366a6fe1 100644 --- a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-10-02' author: Bhavin Patel, Splunk type: Anomaly -status: production +status: validation description: The following analytic identifies services.exe spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned From a23eb85f4f7ce2f85fc9da1557fdb3fd06d79018 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 16:45:06 -0700 Subject: [PATCH 83/89] Removed printout from python code. Committed detection in dist with status validation. --- .../contentctl_core/domain/entities/detection.py | 3 ++- dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 52b95b0391..5a28aa6e6b 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -148,7 +148,8 @@ class Detection(BaseModel, SecurityContentObject): if "ssa_" not in values["file_path"]: raise ValueError(f"The following is NOT an ssa_ detection, but has 'status: {values['status']} which may ONLY be used for ssa_ detections:' {values['file_path']}") else: - print(f"Got an ssa validation detection: {values['file_path']}") + #This is an ssa_ validation detection + pass return values diff --git a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml index adb586b2d9..e00b74c67e 100644 --- a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml +++ b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml @@ -1,7 +1,7 @@ name: Services lolbas Execution Process Spawn id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 version: 1 -status: production +status: validation description: The following analytic identifies services.exe spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned From 87835aded9c3746df43589630b63cc88adfd696b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 2 Oct 2023 16:47:50 -0700 Subject: [PATCH 84/89] Update dev_ssa version of detection as well. --- .../endpoint/ssa___services_lolbas_execution_process_spawn.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml index daa5c65cd7..1fc0fe502a 100644 --- a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -3,7 +3,7 @@ id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 version: 1 date: '2023-10-02' author: Bhavin Patel, Splunk -status: production +status: validation type: Anomaly description: The following analytic identifies services.exe spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned as a child process of services.exe. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of services.exe that are part of the LOLBAS project can help defenders identify lateral movement activity. data_source: From 8f6e67c6140289a5f91dffc6cc746fe82dc7082e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 3 Oct 2023 09:43:22 -0700 Subject: [PATCH 85/89] adding new detection --- .../endpoint/ssa___deleting_shadow_copies.yml | 48 ++++++++ ...ervices_lolbas_execution_process_spawn.yml | 2 +- dist/ssa/srs/ssa___deleting_shadow_copies.yml | 114 ++++++++++++++++++ .../endpoint/ssa___deleting_shadow_copies.yml | 103 ++++++++++++++++ ...ervices_lolbas_execution_process_spawn.yml | 2 +- 5 files changed, 267 insertions(+), 2 deletions(-) create mode 100644 dev_ssa/endpoint/ssa___deleting_shadow_copies.yml create mode 100644 dist/ssa/srs/ssa___deleting_shadow_copies.yml create mode 100644 ssa_detections/endpoint/ssa___deleting_shadow_copies.yml diff --git a/dev_ssa/endpoint/ssa___deleting_shadow_copies.yml b/dev_ssa/endpoint/ssa___deleting_shadow_copies.yml new file mode 100644 index 0000000000..f9bfd16700 --- /dev/null +++ b/dev_ssa/endpoint/ssa___deleting_shadow_copies.yml @@ -0,0 +1,48 @@ +name: Deleting Shadow Copies +id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +date: '2023-10-03' +version: 1 +author: Bhavin Patel, Splunk +status: validation +type: TTP +description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. +data_source: +- Windows Security 4688 +search: + selection1: + process.file.name: + - vssadmin.exe + - wmic.exe + selection2: + process.cmd_line|contains: delete + selection3: + process.cmd_line|contains: shadow + condition: selection1 and selection2 and selection3 +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. +known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed. +references: +- https://atomicredteam.io/impact/T1490/ +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html +tags: + analytic_story: + - Clop Ransomware + - Ransomware + asset_type: Endpoint + confidence: 80 + impact: 80 + message: An instance of shadow copy was deleted was deleted using command line - $process.cmd_line$ with process name `vssadmin.exe` or `wmic.exe` on host machine - $device.hostname$ by user $actor.user.name$. + mitre_attack_id: + - T1490 + observable: [] + product: + - Splunk Behavioral Analytics + required_fields: [] + kill_chain_phases: + - Exploitation + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/4688_xml_windows_security_delete_shadow.log + source: XmlWinEventLog:Security \ No newline at end of file diff --git a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml index 1fc0fe502a..b87fbc53c3 100644 --- a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -99,4 +99,4 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log - source: XMLWinEventLog:Security \ No newline at end of file + source: XmlWinEventLog:Security \ No newline at end of file diff --git a/dist/ssa/srs/ssa___deleting_shadow_copies.yml b/dist/ssa/srs/ssa___deleting_shadow_copies.yml new file mode 100644 index 0000000000..7b4b80488a --- /dev/null +++ b/dist/ssa/srs/ssa___deleting_shadow_copies.yml @@ -0,0 +1,114 @@ +name: Deleting Shadow Copies +id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +version: 1 +status: validation +description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy + Service. Wmic is an interface to the Windows Management Instrumentation. This search + looks for either of these tools being used to delete shadow copies. +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="vssadmin.exe" + OR process_file_name="wmic.exe") AND process_cmd_line LIKE "%delete%" AND process_cmd_line + LIKE "%shadow%" + | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], + time = timestamp, + evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, + message = "Deleting Shadow Copies has been triggered on " + device_hostname + " by " + actor_user_name + ".", + users = [{"name": actor_user_name, "uid": actor_user.uid}], + activity_id = 1, + cis_csc = [{"control": "CIS 10", "version": 8}], + analytic_stories = ["Clop Ransomware", "Ransomware"], + class_name = "Detection Report", + confidence = 80, + confidence_id = 3, + duration = 0, + impact = 80, + impact_id = 5, + kill_chain = [], + nist = ["DE.AE"], + risk_level = "High", + category_uid = 2, + class_uid = 102001, + risk_level_id = 3, + risk_score = 64, + severity_id = 0, + rule = {"name": "Deleting Shadow Copies", "uid": "fd40c537-53d0-4c28-9b7e-77cfd28a49c8", "type": "Streaming"}, + metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, + type_uid = 10200101, + start_time = timestamp, + end_time = timestamp + | fields metadata, rule, activity_id, analytic_stories, cis_csc, category_uid, class_name, class_uid, confidence, confidence_id, devices, duration, time, evidence, impact, impact_id, kill_chain, message, nist, observables, risk_level, risk_level_id, risk_score, severity_id, type_uid, users, start_time, end_time + | into sink; ' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. +known_false_positives: System administrators may resize the shadowstorage for valid + purposes. Filter as needed. +references: +- https://atomicredteam.io/impact/T1490/ +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html +tags: + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 64 + security_domain: endpoint + risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/fd40c537-53d0-4c28-9b7e-77cfd28a49c8/ + event_schema: ocsf + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest + annotations: + analytic_story: + - Clop Ransomware + - Ransomware + cis20: + - CIS 10 + kill_chain_phases: [] + mitre_attack_id: + - T1490 + nist: + - DE.CM +test: + name: Deleting Shadow Copies Unit Test + tests: + - name: Deleting Shadow Copies + attack_data: + - file_name: 4688_xml_windows_security_delete_shadow.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/4688_xml_windows_security_delete_shadow.log + source: XmlWinEventLog:Security +runtime: SPL2 +internalVersion: 2 diff --git a/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml b/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml new file mode 100644 index 0000000000..003b949652 --- /dev/null +++ b/ssa_detections/endpoint/ssa___deleting_shadow_copies.yml @@ -0,0 +1,103 @@ +name: Deleting Shadow Copies +id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +version: 1 +date: '2023-10-03' +author: Bhavin Patel, Splunk +type: TTP +status: validation +description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy + Service. Wmic is an interface to the Windows Management Instrumentation. This search + looks for either of these tools being used to delete shadow copies. +data_source: +- Windows Security 4688 +search: ' $main = from source | eval timestamp = time | eval metadata_uid = metadata.uid | + eval process_pid = process.pid | eval process_file = process.file | eval process_file_path + = process_file.path | eval process_file_name = process_file.name | eval process_cmd_line + = process.cmd_line | eval actor_user = actor.user | eval actor_user_name = actor_user.name + | eval actor_process = actor.process | eval actor_process_pid = actor_process.pid + | eval actor_process_file = actor_process.file | eval actor_process_file_path = + actor_process_file.path | eval actor_process_file_name = actor_process_file.name + | eval device_hostname = device.hostname | where (process_file_name="vssadmin.exe" + OR process_file_name="wmic.exe") AND process_cmd_line LIKE "%delete%" AND process_cmd_line + LIKE "%shadow%" --finding_report--' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. +known_false_positives: System administrators may resize the shadowstorage for valid + purposes. Filter as needed. +references: +- https://atomicredteam.io/impact/T1490/ +- https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html +tags: + analytic_story: + - Clop Ransomware + - Ransomware + asset_type: Endpoint + confidence: 80 + impact: 80 + message: An instance of shadow copy was deleted was deleted using command line - $process.cmd_line$ + with process name `vssadmin.exe` or `wmic.exe` on host machine - $device.hostname$ + by user $actor.user.name$. + mitre_attack_id: + - T1490 + observable: + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File + - name: process.cmd_line + type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname + product: + - Splunk Behavioral Analytics + required_fields: + - process.pid + - process.file.path + - process.file.name + - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname + risk_score: 64 + security_domain: endpoint + mappings: + - ocsf: process.pid + cim: process_id + - ocsf: process.file.path + cim: process_path + - ocsf: process.file.name + cim: process_name + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.name + cim: user + - ocsf: actor.process.pid + cim: parent_process_id + - ocsf: actor.process.file.path + cim: parent_process_path + - ocsf: actor.process.file.name + cim: parent_process_name + - ocsf: device.hostname + cim: dest +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/4688_xml_windows_security_delete_shadow.log + source: XmlWinEventLog:Security diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml index 52366a6fe1..aa077e2c56 100644 --- a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -125,4 +125,4 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log - source: XMLWinEventLog:Security + source: XmlWinEventLog:Security From b28e03b1c7e2086eabd0f71d575d886bbc5b6b18 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 3 Oct 2023 12:12:57 -0700 Subject: [PATCH 86/89] enrichment --- dist/ssa/srs/ssa___deleting_shadow_copies.yml | 5 +++-- .../srs/ssa___services_lolbas_execution_process_spawn.yml | 8 +++++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/dist/ssa/srs/ssa___deleting_shadow_copies.yml b/dist/ssa/srs/ssa___deleting_shadow_copies.yml index 7b4b80488a..110f1f2a93 100644 --- a/dist/ssa/srs/ssa___deleting_shadow_copies.yml +++ b/dist/ssa/srs/ssa___deleting_shadow_copies.yml @@ -29,7 +29,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 80, impact_id = 5, - kill_chain = [], + kill_chain = [{"phase": "Actions on Objectives", "phase_id": 7}], nist = ["DE.AE"], risk_level = "High", category_uid = 2, @@ -97,7 +97,8 @@ tags: - Ransomware cis20: - CIS 10 - kill_chain_phases: [] + kill_chain_phases: + - Actions on Objectives mitre_attack_id: - T1490 nist: diff --git a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml index e00b74c67e..1c16c4db1e 100644 --- a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml +++ b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml @@ -51,7 +51,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me duration = 0, impact = 70, impact_id = 4, - kill_chain = [], + kill_chain = [{"phase": "Installation", "phase_id": 5}, {"phase": "Exploitation", "phase_id": 4}], nist = ["DE.AE"], risk_level = "Low", category_uid = 2, @@ -122,7 +122,9 @@ tags: - Insider Threat cis20: - CIS 10 - kill_chain_phases: [] + kill_chain_phases: + - Installation + - Exploitation mitre_attack_id: - T1543.003 nist: @@ -134,6 +136,6 @@ test: attack_data: - file_name: 4688_xml_windows_security.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/services_lolbas_execution/4688_xml_windows_security.log - source: XMLWinEventLog:Security + source: XmlWinEventLog:Security runtime: SPL2 internalVersion: 2 From ca2a81b55d590513e4bdc4129d48be24077acdf8 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:02:04 -0700 Subject: [PATCH 87/89] add process_path to tstats output --- .../endpoint/system_processes_run_from_unexpected_locations.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index d6e94d08f6..1842a98ffe 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -20,7 +20,7 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process Processes.process_path Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter`' From 393efa390fc0d96ee0968a1aeb6b75318d7c2a97 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 3 Oct 2023 15:25:03 -0700 Subject: [PATCH 88/89] updating the lolbins to lowercase --- ...ervices_lolbas_execution_process_spawn.yml | 113 +++++++++--------- ...ervices_lolbas_execution_process_spawn.yml | 43 +++---- ...ervices_lolbas_execution_process_spawn.yml | 43 +++---- 3 files changed, 100 insertions(+), 99 deletions(-) diff --git a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml index b87fbc53c3..d1458eca8b 100644 --- a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -13,68 +13,67 @@ search: actor.process.file.name: services.exe selection2: process.file.name: - - Regsvcs.exe - - Ftp.exe - - OfflineScannerShell.exe - - Rasautou.exe - - Schtasks.exe - - Xwizard.exe - - Dllhost.exe - - Pnputil.exe - - Atbroker.exe - - Pcwrun.exe - - Ttdinject.exe - - Mshta.exe - - Bitsadmin.exe - - Certoc.exe - - Ieexec.exe - - Microsoft.Workflow.Compiler.exe - - Runscripthelper.exe - - Forfiles.exe - - Msbuild.exe - - Register-cimprovider.exe - - Tttracer.exe - - Ie4uinit.exe - - Bash.exe - - Hh.exe - - SettingSyncHost.exe - - Cmstp.exe - - Mmc.exe - - Stordiag.exe - - Scriptrunner.exe - - Odbcconf.exe - - Extexport.exe - - Msdt.exe - - WorkFolders.exe - - Diskshadow.exe - - Mavinject.exe - - Regasm.exe - - Gpscript.exe - - Rundll32.exe - - Regsvr32.exe - - Msiexec.exe - - Wuauclt.exe - - Presentationhost.exe - - Wmic.exe - - Runonce.exe - - Syncappvpublishingserver.exe - - Verclsid.exe - - Infdefaultinstall.exe - - Explorer.exe - - Installutil.exe - - Netsh.exe - - Wab.exe - - Dnscmd.exe - - At.exe - - Pcalua.exe - - Msconfig.exe + - at.exe + - atbroker.exe + - bash.exe + - bitsadmin.exe + - certoc.exe + - cmd.exe + - cmstp.exe + - dllhost.exe + - dnscmd.exe + - extexport.exe + - explorer.exe + - forfiles.exe + - ftp.exe + - gpscript.exe + - hh.exe + - ie4uinit.exe + - ieexec.exe + - infdefaultinstall.exe + - installutil.exe + - lucallbackproxy.exe + - mavinject.exe + - microsoft.workflow.compiler.exe + - mmc.exe + - msbuild.exe + - msconfig.exe + - msdt.exe + - mshta.exe + - msiexec.exe + - netsh.exe + - odbcconf.exe + - offlinescannershell.exe + - pcwrun.exe + - pcalua.exe + - pnputil.exe + - presentationhost.exe + - rasautou.exe + - regasm.exe + - regsvcs.exe + - regsvr32.exe + - register-cimprovider.exe + - rundll32.exe + - runonce.exe + - runscripthelper.exe + - schtasks.exe + - scriptrunner.exe + - settingsynchost.exe + - stordiag.exe + - syncappvpublishingserver.exe + - ttdinject.exe + - tttracer.exe + - verclsid.exe + - wab.exe + - wmic.exe + - wuauclt.exe + - xwizard.exe condition: (selection1 and selection2) how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: There are circumstances where the services application may legitimately execute and spawn a windows native binary to do an activity that is benign. references: - https://attack.mitre.org/techniques/T1543/003/ -- https://pentestlab.blog/2020/07/21/lateral-movement-services/ - +- https://pentestlab.blog/2020/07/21/lateral-movement-services tags: analytic_story: - Suspicious Command-Line Executions diff --git a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml index 1c16c4db1e..d4ff5e0961 100644 --- a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml +++ b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml @@ -17,26 +17,27 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where actor_process_file_name="services.exe" - AND (process_file_name="Regsvcs.exe" OR process_file_name="Ftp.exe" OR process_file_name="OfflineScannerShell.exe" - OR process_file_name="Rasautou.exe" OR process_file_name="Schtasks.exe" OR process_file_name="Xwizard.exe" - OR process_file_name="Dllhost.exe" OR process_file_name="Pnputil.exe" OR process_file_name="Atbroker.exe" - OR process_file_name="Pcwrun.exe" OR process_file_name="Ttdinject.exe" OR process_file_name="Mshta.exe" - OR process_file_name="Bitsadmin.exe" OR process_file_name="Certoc.exe" OR process_file_name="Ieexec.exe" - OR process_file_name="Microsoft.Workflow.Compiler.exe" OR process_file_name="Runscripthelper.exe" - OR process_file_name="Forfiles.exe" OR process_file_name="Msbuild.exe" OR process_file_name="Register-cimprovider.exe" - OR process_file_name="Tttracer.exe" OR process_file_name="Ie4uinit.exe" OR process_file_name="Bash.exe" - OR process_file_name="Hh.exe" OR process_file_name="SettingSyncHost.exe" OR process_file_name="Cmstp.exe" - OR process_file_name="Mmc.exe" OR process_file_name="Stordiag.exe" OR process_file_name="Scriptrunner.exe" - OR process_file_name="Odbcconf.exe" OR process_file_name="Extexport.exe" OR process_file_name="Msdt.exe" - OR process_file_name="WorkFolders.exe" OR process_file_name="Diskshadow.exe" OR - process_file_name="Mavinject.exe" OR process_file_name="Regasm.exe" OR process_file_name="Gpscript.exe" - OR process_file_name="Rundll32.exe" OR process_file_name="Regsvr32.exe" OR process_file_name="Msiexec.exe" - OR process_file_name="Wuauclt.exe" OR process_file_name="Presentationhost.exe" OR - process_file_name="Wmic.exe" OR process_file_name="Runonce.exe" OR process_file_name="Syncappvpublishingserver.exe" - OR process_file_name="Verclsid.exe" OR process_file_name="Infdefaultinstall.exe" - OR process_file_name="Explorer.exe" OR process_file_name="Installutil.exe" OR process_file_name="Netsh.exe" - OR process_file_name="Wab.exe" OR process_file_name="Dnscmd.exe" OR process_file_name="At.exe" - OR process_file_name="Pcalua.exe" OR process_file_name="Msconfig.exe") + AND (process_file_name="at.exe" OR process_file_name="atbroker.exe" OR process_file_name="bash.exe" + OR process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="cmd.exe" + OR process_file_name="cmstp.exe" OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" + OR process_file_name="extexport.exe" OR process_file_name="explorer.exe" OR process_file_name="forfiles.exe" + OR process_file_name="ftp.exe" OR process_file_name="gpscript.exe" OR process_file_name="hh.exe" + OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" OR process_file_name="infdefaultinstall.exe" + OR process_file_name="installutil.exe" OR process_file_name="lucallbackproxy.exe" + OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" + OR process_file_name="mmc.exe" OR process_file_name="msbuild.exe" OR process_file_name="msconfig.exe" + OR process_file_name="msdt.exe" OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" + OR process_file_name="netsh.exe" OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" + OR process_file_name="pcwrun.exe" OR process_file_name="pcalua.exe" OR process_file_name="pnputil.exe" + OR process_file_name="presentationhost.exe" OR process_file_name="rasautou.exe" + OR process_file_name="regasm.exe" OR process_file_name="regsvcs.exe" OR process_file_name="regsvr32.exe" + OR process_file_name="register-cimprovider.exe" OR process_file_name="rundll32.exe" + OR process_file_name="runonce.exe" OR process_file_name="runscripthelper.exe" OR + process_file_name="schtasks.exe" OR process_file_name="scriptrunner.exe" OR process_file_name="settingsynchost.exe" + OR process_file_name="stordiag.exe" OR process_file_name="syncappvpublishingserver.exe" + OR process_file_name="ttdinject.exe" OR process_file_name="tttracer.exe" OR process_file_name="verclsid.exe" + OR process_file_name="wab.exe" OR process_file_name="wmic.exe" OR process_file_name="wuauclt.exe" + OR process_file_name="xwizard.exe") | eval devices = [{"hostname": device_hostname, "type_id": 0, "uuid": device.uuid}], time = timestamp, evidence = {"process.pid": process_pid, "process.file.path": process_file_path, "process.file.name": process_file_name, "process.cmd_line": process_cmd_line, "actor.user.name": actor_user_name, "actor.process.pid": actor_process_pid, "actor.process.file.path": actor_process_file_path, "actor.process.file.name": actor_process_file_name, "device.hostname": device_hostname}, @@ -80,7 +81,7 @@ known_false_positives: There are circumstances where the services application ma benign. references: - https://attack.mitre.org/techniques/T1543/003/ -- https://pentestlab.blog/2020/07/21/lateral-movement-services/ +- https://pentestlab.blog/2020/07/21/lateral-movement-services tags: required_fields: - process.pid diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml index aa077e2c56..5da87907bb 100644 --- a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -22,26 +22,27 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me | eval actor_process_file = actor_process.file | eval actor_process_file_path = actor_process_file.path | eval actor_process_file_name = actor_process_file.name | eval device_hostname = device.hostname | where actor_process_file_name="services.exe" - AND (process_file_name="Regsvcs.exe" OR process_file_name="Ftp.exe" OR process_file_name="OfflineScannerShell.exe" - OR process_file_name="Rasautou.exe" OR process_file_name="Schtasks.exe" OR process_file_name="Xwizard.exe" - OR process_file_name="Dllhost.exe" OR process_file_name="Pnputil.exe" OR process_file_name="Atbroker.exe" - OR process_file_name="Pcwrun.exe" OR process_file_name="Ttdinject.exe" OR process_file_name="Mshta.exe" - OR process_file_name="Bitsadmin.exe" OR process_file_name="Certoc.exe" OR process_file_name="Ieexec.exe" - OR process_file_name="Microsoft.Workflow.Compiler.exe" OR process_file_name="Runscripthelper.exe" - OR process_file_name="Forfiles.exe" OR process_file_name="Msbuild.exe" OR process_file_name="Register-cimprovider.exe" - OR process_file_name="Tttracer.exe" OR process_file_name="Ie4uinit.exe" OR process_file_name="Bash.exe" - OR process_file_name="Hh.exe" OR process_file_name="SettingSyncHost.exe" OR process_file_name="Cmstp.exe" - OR process_file_name="Mmc.exe" OR process_file_name="Stordiag.exe" OR process_file_name="Scriptrunner.exe" - OR process_file_name="Odbcconf.exe" OR process_file_name="Extexport.exe" OR process_file_name="Msdt.exe" - OR process_file_name="WorkFolders.exe" OR process_file_name="Diskshadow.exe" OR - process_file_name="Mavinject.exe" OR process_file_name="Regasm.exe" OR process_file_name="Gpscript.exe" - OR process_file_name="Rundll32.exe" OR process_file_name="Regsvr32.exe" OR process_file_name="Msiexec.exe" - OR process_file_name="Wuauclt.exe" OR process_file_name="Presentationhost.exe" OR - process_file_name="Wmic.exe" OR process_file_name="Runonce.exe" OR process_file_name="Syncappvpublishingserver.exe" - OR process_file_name="Verclsid.exe" OR process_file_name="Infdefaultinstall.exe" - OR process_file_name="Explorer.exe" OR process_file_name="Installutil.exe" OR process_file_name="Netsh.exe" - OR process_file_name="Wab.exe" OR process_file_name="Dnscmd.exe" OR process_file_name="At.exe" - OR process_file_name="Pcalua.exe" OR process_file_name="Msconfig.exe") --finding_report--' + AND (process_file_name="at.exe" OR process_file_name="atbroker.exe" OR process_file_name="bash.exe" + OR process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="cmd.exe" + OR process_file_name="cmstp.exe" OR process_file_name="dllhost.exe" OR process_file_name="dnscmd.exe" + OR process_file_name="extexport.exe" OR process_file_name="explorer.exe" OR process_file_name="forfiles.exe" + OR process_file_name="ftp.exe" OR process_file_name="gpscript.exe" OR process_file_name="hh.exe" + OR process_file_name="ie4uinit.exe" OR process_file_name="ieexec.exe" OR process_file_name="infdefaultinstall.exe" + OR process_file_name="installutil.exe" OR process_file_name="lucallbackproxy.exe" + OR process_file_name="mavinject.exe" OR process_file_name="microsoft.workflow.compiler.exe" + OR process_file_name="mmc.exe" OR process_file_name="msbuild.exe" OR process_file_name="msconfig.exe" + OR process_file_name="msdt.exe" OR process_file_name="mshta.exe" OR process_file_name="msiexec.exe" + OR process_file_name="netsh.exe" OR process_file_name="odbcconf.exe" OR process_file_name="offlinescannershell.exe" + OR process_file_name="pcwrun.exe" OR process_file_name="pcalua.exe" OR process_file_name="pnputil.exe" + OR process_file_name="presentationhost.exe" OR process_file_name="rasautou.exe" + OR process_file_name="regasm.exe" OR process_file_name="regsvcs.exe" OR process_file_name="regsvr32.exe" + OR process_file_name="register-cimprovider.exe" OR process_file_name="rundll32.exe" + OR process_file_name="runonce.exe" OR process_file_name="runscripthelper.exe" OR + process_file_name="schtasks.exe" OR process_file_name="scriptrunner.exe" OR process_file_name="settingsynchost.exe" + OR process_file_name="stordiag.exe" OR process_file_name="syncappvpublishingserver.exe" + OR process_file_name="ttdinject.exe" OR process_file_name="tttracer.exe" OR process_file_name="verclsid.exe" + OR process_file_name="wab.exe" OR process_file_name="wmic.exe" OR process_file_name="wuauclt.exe" + OR process_file_name="xwizard.exe") --finding_report--' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -56,7 +57,7 @@ known_false_positives: There are circumstances where the services application ma benign. references: - https://attack.mitre.org/techniques/T1543/003/ -- https://pentestlab.blog/2020/07/21/lateral-movement-services/ +- https://pentestlab.blog/2020/07/21/lateral-movement-services tags: analytic_story: - Suspicious Command-Line Executions From 3d2182287320c96824b0b2902cd10c4d8be85fde Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 3 Oct 2023 17:31:15 -0700 Subject: [PATCH 89/89] Update uuid with new one --- .../ssa___services_lolbas_execution_process_spawn.yml | 2 +- .../srs/ssa___services_lolbas_execution_process_spawn.yml | 6 +++--- .../ssa___services_lolbas_execution_process_spawn.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml index d1458eca8b..e2d3313646 100644 --- a/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/dev_ssa/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -1,5 +1,5 @@ name: Services lolbas Execution Process Spawn -id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +id: 0d85fde3-0de9-4eec-b386-6a8ba70f3935 version: 1 date: '2023-10-02' author: Bhavin Patel, Splunk diff --git a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml index d4ff5e0961..d05ad337f5 100644 --- a/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml +++ b/dist/ssa/srs/ssa___services_lolbas_execution_process_spawn.yml @@ -1,5 +1,5 @@ name: Services lolbas Execution Process Spawn -id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +id: 0d85fde3-0de9-4eec-b386-6a8ba70f3935 version: 1 status: validation description: The following analytic identifies services.exe spawning a LOLBAS execution @@ -60,7 +60,7 @@ search: ' $main = from source | eval timestamp = time | eval metadata_uid = me risk_level_id = 1, risk_score = 35, severity_id = 0, - rule = {"name": "Services lolbas Execution Process Spawn", "uid": "fd40c537-53d0-4c28-9b7e-77cfd28a49c8", "type": "Streaming"}, + rule = {"name": "Services lolbas Execution Process Spawn", "uid": "0d85fde3-0de9-4eec-b386-6a8ba70f3935", "type": "Streaming"}, metadata = {"customer_uid": metadata.customer_uid, "product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2", "logged_time": time()}, type_uid = 10200101, start_time = timestamp, @@ -96,7 +96,7 @@ tags: risk_score: 35 security_domain: endpoint risk_severity: low - research_site_url: https://research.splunk.com/endpoint/fd40c537-53d0-4c28-9b7e-77cfd28a49c8/ + research_site_url: https://research.splunk.com/endpoint/0d85fde3-0de9-4eec-b386-6a8ba70f3935/ event_schema: ocsf mappings: - ocsf: process.pid diff --git a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml index 5da87907bb..16a5caab63 100644 --- a/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml +++ b/ssa_detections/endpoint/ssa___services_lolbas_execution_process_spawn.yml @@ -1,5 +1,5 @@ name: Services lolbas Execution Process Spawn -id: fd40c537-53d0-4c28-9b7e-77cfd28a49c8 +id: 0d85fde3-0de9-4eec-b386-6a8ba70f3935 version: 1 date: '2023-10-02' author: Bhavin Patel, Splunk