diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 3071d016f9..659db6358f 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -45,7 +45,7 @@ jobs: git fetch origin pull/${{ github.event.pull_request.number }}/head:new_branch_for_testing #We must specifically get the PR's target branch from security_content, not the one that resides in the fork PR's forked repo git switch new_branch_for_testing - contentctl test --disable-tqdm --no-enable-integration-testing --container-settings.num-containers 2 --post-test-behavior never_pause mode:changes --mode.target-branch ${{ github.base_ref }} + contentctl test --verbose --disable-tqdm --no-enable-integration-testing --container-settings.num-containers 2 --post-test-behavior never_pause mode:changes --mode.target-branch ${{ github.base_ref }} echo "contentctl test - COMPLETED" continue-on-error: true diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 6393155303..71f4357125 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -69,5 +69,14 @@ fields: - vendor_product - version - vpcflow_action +output_fields: +- action +- src +- src_ip +- src_port +- dest +- dest_ip +- dest_port +- transport example_log: 2 123397614277 eni-0b0f9f261f45e6489 10.0.1.30 10.0.1.1 47254 22 17 2 98 1697608042 1697608070 ACCEPT OK diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index b9b50b6070..ec0cb74813 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -99,6 +99,27 @@ fields: - user - user_id - vendor_product +output_fields: + - action + - dest + - original_file_name + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - process + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - user + - user_id + - vendor_product field_mappings: - data_model: cim data_set: Endpoint.Processes diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 3d83e462b9..64071d80af 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -17,3 +17,7 @@ supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 version: 3.0.0 +output_fields: +- dest +- src +- user \ No newline at end of file diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index be5d270e69..a486085366 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -27,6 +27,13 @@ field_mappings: url: Web.url url_length: Web.url_length src: Web.src +output_fields: +- http_user_agent +- http_method +- url +- url_length +- src +- dest fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 7477b93f66..a2f3147ddc 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -36,6 +36,24 @@ fields: - splunk_server - timeendpos - timestartpos +output_fields: +- action +- app +- bytes +- bytes_in +- bytes_out +- dest +- dest_ip +- dest_port +- dvc +- protocol +- protocol_version +- src +- src_ip +- src_port +- transport +- user +- vendor_product field_mappings: - data_model: cim data_set: All_Traffic diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index a92378edf7..7ffb17d150 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -73,6 +73,19 @@ fields: - timestartpos - user_id - vendor_product +output_fields: +- dest +- signature +- signature_id +- user_id +- vendor_product +- Guid +- Opcode +- Name +- Path +- ProcessID +- ScriptBlockId +- ScriptBlockText field_mappings: - data_model: cim data_set: Endpoint.Processes diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index 82abab53f8..a2c51e613c 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -117,6 +117,27 @@ fields: - user - user_id - vendor_product +output_fields: + - action + - dest + - original_file_name + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - process + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - user + - user_id + - vendor_product field_mappings: - data_model: cim data_set: Endpoint.Processes diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index 8afd1accf9..9a2c613618 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -98,6 +98,19 @@ fields: - timestartpos - user_id - vendor_product +output_fields: +- dest +- user_id +- parent_process_name +- parent_process_guid +- process_name +- process_guid +- process_id +- signature +- SourceImage +- TargetImage +- GrantedAccess +- CallTrace example_log: 10341000x800000000000000015062441215241500x800000000000000066786017141700x800000000000000016216818141800x800000000000000016217320342000x8000000000000000624921342100x800000000000000015164422542200x800000000000000011389223542300x8000000000000000281771354300x8000000000000000156837534500x800000000000000039965644600x800000000000000015708989734700x800000000000000045273824800x8000000000000000362233924900x8000000000000000190607228202000x80000000000000300004000x8000000000000011000410300x402000000000000014087411020410400x402000000000000018261664624201254400x80200000000000003718864625001254400x80100000000000003673484627001255400x80200000000000001862604648001254400x80200000000000003365674662001408000x8010000000000000216231982764663101280000x8020000000000000105258694672001254800x80200000000000001489464703001331700x80200000000000003287614719001356800x80200000000000003535974724001382400x80200000000000002767794725001382400x80200000000000002787714726001382400x80200000000000002792834727001382600x8020000000000000183204880Securityar-win-dc.attackrange.localESX AdminsATTACKRANGEATTACKRANGE\ESX AdminsATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 7880ef1041..90c926d7f1 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -13,4 +13,6 @@ supported_TA: version: 9.0.1 fields: - _time +output_fields: +- dest example_log: |- diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index fb8dfacd98..3d715dab64 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -99,5 +99,7 @@ fields: - _sourcetype - _subsecond - _time +output_fields: +- dest example_log: |- 4730001382600x8020000000000000183203591Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0- diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 0ebe013f2e..c6f5846d89 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -13,4 +13,6 @@ supported_TA: version: 9.0.1 fields: - _time +output_fields: +- dest example_log: |- diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 5f312c3965..a3a8b497ff 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -99,4 +99,6 @@ fields: - vendor - vendor_privilege - vendor_product +output_fields: +- dest example_log: 10/09/2020 10:41:26 AM diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index da1cf8e687..e89bf32f84 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -99,6 +99,8 @@ fields: - _sourcetype - _subsecond - _time +output_fields: +- dest example_log: |- 4737001382600x8020000000000000183186860Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0--- diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index b42d8f7fa2..161b28d7b9 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -120,6 +120,8 @@ fields: - user_name - vendor - vendor_product +output_fields: +- dest example_log: 4738001382400x802000000000000063897134739001356900x80200000000000003941764741001382500x80200000000000001434754742001382500x80200000000000009018604768001433900x80100000000000003915624769001433700x80200000000000001485214771001433900x80100000000000003915114776001433600x80100000000000003916154781001382400x80200000000000001487634794001382400x80200000000000008210774798001382400x80200000000000003868604876001280500x8020000000000000153799614886001280500x8020000000000000153799254887001280500x802000000000000018309746095136001408100x802000000000000019973655137001408100x80200000000000001701405141001408100x8020000000000000670908703604000x8080000000000000704004000x8080000000000000704504000x80800000000000002001420010x80000000000000004323- - | tstats `security_content_summariesonly` values(Authentication.user) AS unique_user_names - dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) - as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" - NOT Authentication.src IN ("-","unknown") by Authentication.src, Authentication.action, - Authentication.signature_id, sourcetype, _time span=5m | `drop_dm_object_name("Authentication")` - ```fill out time buckets for 0-count events during entire search length``` - | appendpipe [| timechart limit=0 span=5m count | table _time] - | fillnull value=0 unique_accounts - ``` Create aggregation field & apply to all null events``` - | eval counter=src+"__"+sourcetype+"__"+signature_id | eventstats values(counter) - as fnscounter | eval counter=coalesce(counter,fnscounter) - ``` stats version of mvexpand ``` - | stats values(app) as app values(unique_user_names) as unique_user_names values(total_failures) - as total_failures values(src) as src values(signature_id) as signature_id values(sourcetype) - as sourcetype count by counter unique_accounts _time - ``` remove duplicate time buckets for each unique source``` - | sort - _time unique_accounts - | dedup _time counter - ```Find the outliers``` - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std - by counter - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0) - | replace "::ffff:*" with * in src | where isOutlier=1 | foreach * - [ eval <> = if(<>="null",null(),<>)] - | table _time, src, action, app, unique_accounts, unique_user_names, total_failures, - sourcetype, signature_id, counter - | `detect_password_spray_attempts_filter` -how_to_implement: >- - Ensure in-scope authentication data is CIM mapped and the src field is populated - with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly. - This search opporates best on a 5 minute schedule, looking back over the past 70 - minutes. Configure 70 minute throttling on the two fields _time and counter. +search: "| tstats `security_content_summariesonly` values(Authentication.user) AS\ + \ unique_user_names dc(Authentication.user) AS unique_accounts values(Authentication.app)\ + \ as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication\ + \ where Authentication.action=\"failure\" NOT Authentication.src IN (\"-\",\"unknown\"\ + ) by Authentication.action Authentication.app Authentication.authentication_method\ + \ Authentication.dest \n Authentication.signature Authentication.signature_id Authentication.src\ + \ sourcetype _time span=5m \n| `drop_dm_object_name(\"Authentication\")`\n ```fill\ + \ out time buckets for 0-count events during entire search length```\n| appendpipe\ + \ [| timechart limit=0 span=5m count | table _time] | fillnull value=0 unique_accounts\n\ + \ ``` Create aggregation field & apply to all null events```\n| eval counter=src+\"\ + __\"+sourcetype+\"__\"+signature_id | eventstats values(counter) as fnscounter\ + \ | eval counter=coalesce(counter,fnscounter) \n ``` stats version of mvexpand\ + \ ```\n| stats values(app) as app values(unique_user_names) as unique_user_names\ + \ values(total_failures) as total_failures values(src) as src values(signature_id)\ + \ as signature_id values(sourcetype) as sourcetype count by counter unique_accounts\ + \ _time\n ``` remove duplicate time buckets for each unique source```\n| sort\ + \ - _time unique_accounts | dedup _time counter\n ```Find the outliers```\n|\ + \ eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std\ + \ by counter | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts\ + \ > 30 and unique_accounts >= upperBound, 1, 0) | replace \"::ffff:*\" with * in\ + \ src | where isOutlier=1 | foreach * \n [ eval <> = if(<>=\"\ + null\",null(),<>)] \n| table _time, src, action, app, unique_accounts, unique_user_names,\ + \ total_failures, sourcetype, signature_id, counter | `detect_password_spray_attempts_filter`" +how_to_implement: 'Ensure in-scope authentication data is CIM mapped and the src field + is populated with the source device. Also ensure fill_nullvalue is set within the + macro security_content_summariesonly. This search opporates best on a 5 minute schedule, + looking back over the past 70 minutes. Configure 70 minute throttling on the two + fields _time and counter. ' known_false_positives: Unknown references: - https://attack.mitre.org/techniques/T1110/003/ @@ -91,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index 0530cd1aa9..e3a6e01a10 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -1,6 +1,6 @@ name: Email files written outside of the Outlook directory id: 8d52cf03-ba25-4101-aa78-07994aed4f74 -version: 7 +version: 8 date: '2025-02-10' author: Bhavin Patel, Splunk status: experimental @@ -19,9 +19,11 @@ search: '| tstats `security_content_summariesonly` count values(Filesystem.file_ as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name=*.pst OR Filesystem.file_name=*.ost) Filesystem.file_path != "C:\\Users\\*\\My Documents\\Outlook Files\\*" Filesystem.file_path!="C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*" - by Filesystem.action Filesystem.process_id Filesystem.file_name Filesystem.dest - | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `email_files_written_outside_of_the_outlook_directory_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name("Filesystem")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `email_files_written_outside_of_the_outlook_directory_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response diff --git a/detections/application/okta_multi_factor_authentication_disabled.yml b/detections/application/okta_multi_factor_authentication_disabled.yml index 96cda4186d..1f00b30af6 100644 --- a/detections/application/okta_multi_factor_authentication_disabled.yml +++ b/detections/application/okta_multi_factor_authentication_disabled.yml @@ -1,6 +1,6 @@ name: Okta Multi-Factor Authentication Disabled id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk data_source: @@ -19,8 +19,8 @@ search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, as firstTime from datamodel=Change where sourcetype="OktaIM2:log" All_Changes.object_category=User AND All_Changes.action=modified All_Changes.command=user.mfa.factor.deactivate by All_Changes.user All_Changes.result All_Changes.command sourcetype All_Changes.src - | `drop_dm_object_name("All_Changes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `okta_multi_factor_authentication_disabled_filter`' + All_Changes.dest | `drop_dm_object_name("All_Changes")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `okta_multi_factor_authentication_disabled_filter`' how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). known_false_positives: Legitimate use case may require for users to disable MFA. Filter @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_multiple_accounts_locked_out.yml b/detections/application/okta_multiple_accounts_locked_out.yml index 4a83589bca..75c71fe9a2 100644 --- a/detections/application/okta_multiple_accounts_locked_out.yml +++ b/detections/application/okta_multiple_accounts_locked_out.yml @@ -1,6 +1,6 @@ name: Okta Multiple Accounts Locked Out id: a511426e-184f-4de6-8711-cfd2af29d1e1 -version: 4 +version: 5 date: '2025-01-21' author: Michael Haag, Mauricio Velazco, Splunk data_source: @@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, as firstTime values(All_Changes.user) as user from datamodel=Change where All_Changes.change_type=AAA All_Changes.object_category=User AND All_Changes.action=lockout AND All_Changes.command=user.account.lock by _time span=5m All_Changes.result All_Changes.command sourcetype All_Changes.src - | where count > 5 | `drop_dm_object_name("All_Changes")` | `security_content_ctime(firstTime)` + All_Changes.dest | where count > 5 | `drop_dm_object_name("All_Changes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_multiple_accounts_locked_out_filter`' how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml index c5659a666c..480bfba483 100644 --- a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml +++ b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml @@ -1,6 +1,6 @@ name: Okta Multiple Failed MFA Requests For User id: 826dbaae-a1e6-4c8c-b384-d16898956e73 -version: 5 +version: 6 date: '2025-01-21' author: Mauricio Velazco, Splunk data_source: @@ -17,8 +17,8 @@ description: The following analytic identifies multiple failed multi-factor auth search: '`okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE debugContext.debugData.factor!=PASSWORD_AS_FACTOR | bucket _time span=5m | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) values(src_ip) - as src_ip values(debugContext.debugData.factor) by _time src_user | where count - >= 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + as src_ip values(debugContext.debugData.factor) values(dest) as dest by _time src_user + | where count >= 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). @@ -63,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml index ba4d1413d8..7a9dd565c7 100644 --- a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml @@ -1,6 +1,6 @@ name: Okta Multiple Users Failing To Authenticate From Ip id: de365ffa-42f5-46b5-b43f-fa72290b8218 -version: 5 +version: 6 date: '2025-01-21' author: Michael Haag, Mauricio Velazco, Splunk data_source: @@ -18,9 +18,10 @@ description: The following analytic identifies instances where more than 10 uniq search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime dc(Authentication.user) as unique_accounts values(Authentication.signature) as signature values(Authentication.user) as user values(Authentication.app) as app - values(Authentication.authentication_method) as authentication_method from datamodel=Authentication - where Authentication.action="failure" AND Authentication.signature=user.session.start - by _time span=5m Authentication.src sourcetype | where unique_accounts > 9 | `drop_dm_object_name("Authentication")` + values(Authentication.authentication_method) as authentication_method values(Authentication.dest) + as dest from datamodel=Authentication where Authentication.action="failure" AND + Authentication.signature=user.session.start by _time span=5m Authentication.src + sourcetype | where unique_accounts > 9 | `drop_dm_object_name("Authentication")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_new_api_token_created.yml b/detections/application/okta_new_api_token_created.yml index 27e4bf7c50..a99f98dad1 100644 --- a/detections/application/okta_new_api_token_created.yml +++ b/detections/application/okta_new_api_token_created.yml @@ -1,6 +1,6 @@ name: Okta New API Token Created id: c3d22720-35d3-4da4-bd0a-740d37192bd4 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk status: production @@ -18,8 +18,9 @@ data_source: search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where All_Changes.action=created AND All_Changes.command=system.api_token.create by _time span=5m All_Changes.user All_Changes.result All_Changes.command sourcetype - All_Changes.src All_Changes.action All_Changes.object_category | `drop_dm_object_name("All_Changes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_new_api_token_created_filter`' + All_Changes.src All_Changes.action All_Changes.object_category All_Changes.dest + | `drop_dm_object_name("All_Changes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `okta_new_api_token_created_filter`' how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). known_false_positives: False positives may be present. Tune Okta and tune the analytic @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_new_device_enrolled_on_account.yml b/detections/application/okta_new_device_enrolled_on_account.yml index 0b28586594..6522437728 100644 --- a/detections/application/okta_new_device_enrolled_on_account.yml +++ b/detections/application/okta_new_device_enrolled_on_account.yml @@ -1,6 +1,6 @@ name: Okta New Device Enrolled on Account id: bb27cbce-d4de-432c-932f-2e206e9130fb -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk status: production @@ -18,8 +18,9 @@ data_source: search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where All_Changes.action=created All_Changes.command=device.enrollment.create by _time span=5m All_Changes.user All_Changes.result All_Changes.command sourcetype - All_Changes.src All_Changes.action All_Changes.object_category | `drop_dm_object_name("All_Changes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_new_device_enrolled_on_account_filter`' + All_Changes.src All_Changes.action All_Changes.object_category All_Changes.dest + | `drop_dm_object_name("All_Changes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `okta_new_device_enrolled_on_account_filter`' how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). known_false_positives: It is possible that the user has legitimately added a new device @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_successful_single_factor_authentication.yml b/detections/application/okta_successful_single_factor_authentication.yml index a5a4a3bf14..b3e64eb591 100644 --- a/detections/application/okta_successful_single_factor_authentication.yml +++ b/detections/application/okta_successful_single_factor_authentication.yml @@ -1,6 +1,6 @@ name: Okta Successful Single Factor Authentication id: 98f6ad4f-4325-4096-9d69-45dc8e638e82 -version: 5 +version: 6 date: '2025-02-10' author: Bhavin Patel, Splunk data_source: @@ -18,7 +18,7 @@ search: '`okta` action=success src_user_type = User eventType = user.authentica OR eventType = user.authentication.auth_via_mfa| stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method) by - src_ip user action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + src_ip user action dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search targets !="Okta Verify" | `okta_successful_single_factor_authentication_filter`' how_to_implement: This detection utilizes logs from Okta environments and requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth.log source: okta_log sourcetype: OktaIM2:log diff --git a/detections/application/okta_suspicious_activity_reported.yml b/detections/application/okta_suspicious_activity_reported.yml index 1f2662268e..ebd37b322f 100644 --- a/detections/application/okta_suspicious_activity_reported.yml +++ b/detections/application/okta_suspicious_activity_reported.yml @@ -1,6 +1,6 @@ name: Okta Suspicious Activity Reported id: bfc840f5-c9c6-454c-aa13-b46fd0bf1e79 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -17,7 +17,7 @@ data_source: - Okta search: '`okta` eventType=user.account.report_suspicious_activity_by_enduser | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user - eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country + dest src eventType client.userAgent.rawUserAgent client.userAgent.browser client.geographicalContext.city client.geographicalContext.country | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_suspicious_activity_reported_filter`' how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/application/okta_suspicious_use_of_a_session_cookie.yml index cc38b599fc..1eaa45a784 100644 --- a/detections/application/okta_suspicious_use_of_a_session_cookie.yml +++ b/detections/application/okta_suspicious_use_of_a_session_cookie.yml @@ -1,6 +1,6 @@ name: Okta Suspicious Use of a Session Cookie id: 71ad47d1-d6bd-4e0a-b35c-020ad9a6959e -version: 5 +version: 6 date: '2025-01-21' author: Scott Dermott, Felicity Robson, Okta, Michael Haag, Bhavin Patel, Splunk type: Anomaly @@ -21,8 +21,8 @@ search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN (ALLOW, as city, values(client.userAgent.browser) as userAgentBrowser_list, values(device.os_platform) as okta_device_os, dc(client.userAgent.browser) as dc_userAgentBrowser, dc(client.userAgent.os) as dc_userAgentOS, dc(client.ipAddress) as dc_src_ip, values(outcome.reason) as - reason by debugContext.debugData.dtHash, user | where dc_src_ip>1 AND (dc_userAgentOS>1 - OR dc_userAgentBrowser>1) | `okta_suspicious_use_of_a_session_cookie_filter`' + reason values(dest) as dest by debugContext.debugData.dtHash, user | where dc_src_ip>1 + AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1) | `okta_suspicious_use_of_a_session_cookie_filter`' how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_threatinsight_threat_detected.yml b/detections/application/okta_threatinsight_threat_detected.yml index 264bf76c91..5b74baf959 100644 --- a/detections/application/okta_threatinsight_threat_detected.yml +++ b/detections/application/okta_threatinsight_threat_detected.yml @@ -1,6 +1,6 @@ name: Okta ThreatInsight Threat Detected id: 140504ae-5fe2-4d65-b2bc-a211813fbca6 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk status: production @@ -17,8 +17,8 @@ data_source: search: '`okta` eventType = security.threat.detected | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats count min(_time) as firstTime max(_time) as lastTime by app src_ip - signature eventType displayMessage client.device city state country user_agent outcome.reason - outcome.result severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + dest signature eventType displayMessage client.device city state country user_agent + outcome.reason outcome.result severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_threatinsight_threat_detected_filter`' how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/okta_unauthorized_access_to_application.yml b/detections/application/okta_unauthorized_access_to_application.yml index eb6bafb02b..256136edbc 100644 --- a/detections/application/okta_unauthorized_access_to_application.yml +++ b/detections/application/okta_unauthorized_access_to_application.yml @@ -1,6 +1,6 @@ name: Okta Unauthorized Access to Application id: 5f661629-9750-4cb9-897c-1f05d6db8727 -version: 4 +version: 5 date: '2025-01-21' author: Bhavin Patel, Splunk data_source: @@ -18,7 +18,7 @@ search: '| tstats values(Authentication.app) as app values(Authentication.action as action values(Authentication.user) as user values(Authentication.reason) as reason from datamodel=Authentication where Authentication.signature=app.generic.unauth_app_access_attempt Authentication.action="failure" by _time Authentication.src Authentication.user - | `drop_dm_object_name("Authentication")` | `security_content_ctime(firstTime)` + Authentication.dest | `drop_dm_object_name("Authentication")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | iplocation src | `okta_unauthorized_access_to_application_filter`' how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments and requires the ingestion of OktaIm2 logs through the Splunk Add-on @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access.log source: Okta sourcetype: OktaIM2:log diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml deleted file mode 100644 index 33608327e8..0000000000 --- a/detections/application/windows_ad_self_dacl_assignment.yml +++ /dev/null @@ -1,87 +0,0 @@ -name: Windows AD Self DACL Assignment -id: 16132445-da9f-4d03-ad44-56d717dcd67d -version: 4 -date: '2025-02-17' -author: Dean Luxton -status: production -type: TTP -data_source: -- Windows Event Log Security 5136 -description: Detect when a user creates a new DACL in AD for their own AD object. -search: "`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType==\"\ - %%14675\",AttributeValue,null))) as old_value values(eval(if(OperationType==\"%%14674\"\ - ,AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass - ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 - \"\\((?P.*?)\\)\" | rex field=new_value max_match=10000 \"\\((?P.*?)\\\ - )\" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace - \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup - flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup - access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup - guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID - resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT - downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT - cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT - builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), - aceInheritance=coalesce(ace_flag_value,\"This object only\"), aceAccessRights=if(aceAccessRights=\"\ - CCDCLCSWRPWPDTLOCRSDRCWDWO\",\"Full control\",coalesce(access_rights_value,AccessRights)), - aceControlAccessRights=if((ControlAccessRights=\"Write member\" OR aceObjectGuid=\"\ - bf9679c0-0de6-11d0-a285-00aa003049e2\") AND (aceAccessRights=\"All validated writes\"\ - \ OR AccessRights=\"SW\"),\"Add/remove self as member\",coalesce(ControlAccessRights,aceObjectGuid)), - user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType - values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights - values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) - as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user - OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 - AND aceControlAccessRights=\"\",\"All rights\",'aceControlAccessRights') | rex field=user - \"\\\\\\(?P.*?)$\" | where lower(src_user)=lower(nt_user) | `windows_ad_self_dacl_assignment_filter`" -how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically - event 5136. See lantern article in references for further on how to onboard AD audit - data. Ensure the wineventlog_security macro is configured with the correct indexes - and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. -known_false_positives: Unknown -references: -- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory -drilldown_searches: -- name: View the detection results for - "$src_user$" - search: '%original_detection_search% | search src_user = "$src_user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src_user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_user$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: $src_user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ - across $aceAccessRights$ - risk_objects: - - field: src_user - type: user - score: 80 - threat_objects: [] -tags: - analytic_story: - - Sneaky Active Directory Persistence Tricks - asset_type: Endpoint - mitre_attack_id: - - T1484 - - T1098 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml index 4c59fbe732..03a31cc626 100644 --- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml @@ -1,7 +1,7 @@ name: AWS Unusual Number of Failed Authentications From Ip id: 0b5c9c2b-e2cb-4831-b4f1-af125ceb1386 -version: 7 -date: '2025-02-10' +version: 10 +date: '2025-03-27' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -14,15 +14,17 @@ description: The following analytic identifies a single source IP failing to aut unauthorized access, data breaches, or further exploitation within the AWS environment. data_source: - AWS CloudTrail ConsoleLogin -search: '`cloudtrail` eventName=ConsoleLogin action=failure - | bucket span=10m _time - | stats dc(_raw) AS distinct_attempts values(user_name) as tried_accounts values(action) as action values(dest) as dest - values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(vendor_product) as vendor_product values(user_agent) as user_agent by _time, src - | eventstats avg(distinct_attempts) as avg_attempts , stdev(distinct_attempts) as ip_std by _time - | eval upperBound=(avg_attempts+ip_std*3) - | eval isOutlier=if(distinct_attempts > 10 and distinct_attempts >= upperBound, 1, 0) - | where isOutlier = 1 - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_unusual_number_of_failed_authentications_from_ip_filter`' +search: '`cloudtrail` eventName=ConsoleLogin action=failure | rename eventName as + action, eventSource as dest, userName as user, userAgent as user_agent, sourceIPAddress + as src, userIdentity.accountId as vendor_account, awsRegion as vendor_region | bucket + span=10m _time | stats dc(_raw) AS distinct_attempts values(user_name) as tried_accounts + values(action) as action values(dest) as dest values(vendor_account) as vendor_account + values(vendor_region) as vendor_region values(vendor_product) as vendor_product + values(user_agent) as user_agent by _time, src | eventstats avg(distinct_attempts) + as avg_attempts , stdev(distinct_attempts) as ip_std by _time | eval upperBound=(avg_attempts+ip_std*3) + | eval isOutlier=if(distinct_attempts > 10 and distinct_attempts >= upperBound, + 1, 0) | where isOutlier = 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json source: aws_cloudtrail sourcetype: aws:cloudtrail diff --git a/detections/deprecated/detect_large_outbound_icmp_packets.yml b/detections/deprecated/detect_large_outbound_icmp_packets.yml index f8bac938a3..0e81ba771f 100644 --- a/detections/deprecated/detect_large_outbound_icmp_packets.yml +++ b/detections/deprecated/detect_large_outbound_icmp_packets.yml @@ -15,14 +15,16 @@ description: This analytic has been deprecated in favour of a better named detec the network. data_source: - Palo Alto Network Traffic -search: "| tstats `security_content_summariesonly` count earliest(_time) as firstTime\n\ - \ latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes)\n\ - as bytes from\n datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp\n\ - OR All_Traffic.transport=icmp) All_Traffic.bytes\n > 1000 AND NOT All_Traffic.dest_ip\ - \ IN (\"10.0.0.0/8\",\"172.16.0.0/12\",\"192.168.0.0/16\")\nby All_Traffic.src_ip\ - \ All_Traffic.dest_ip All_Traffic.protocol | `drop_dm_object_name(\"All_Traffic\"\ - )` | iplocation dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ - \ | `detect_large_outbound_icmp_packets_filter`" +search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime + latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes) + as bytes from datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp + OR All_Traffic.transport=icmp) All_Traffic.bytes > 1000 AND NOT All_Traffic.dest_ip + IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.action All_Traffic.app + All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip + All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version + All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | iplocation dest_ip | `detect_large_outbound_icmp_packets_filter`' how_to_implement: 'In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have a good understanding of how your network segments are designed and that you are able diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index 052abeb87b..5eb1686278 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -1,6 +1,6 @@ name: 7zip CommandLine To SMB Share Path id: 01d29b48-ff6f-11eb-b81e-acde48001123 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -21,9 +21,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Processes.process_name = "7za.exe" OR Processes.process_name = "7zr.exe" OR Processes.original_file_name = "7z.exe" OR Processes.original_file_name = "7za.exe" OR Processes.original_file_name = "7zr.exe") AND (Processes.process="*\\C$\\*" OR Processes.process="*\\Admin$\\*" - OR Processes.process="*\\IPC$\\*") by Processes.original_file_name Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.parent_process_id - Processes.process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` + OR Processes.process="*\\IPC$\\*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `7zip_commandline_to_smb_share_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -51,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index 0f261b491b..1b938ec591 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -1,6 +1,6 @@ name: Access LSASS Memory for Dump Creation id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 -version: 7 +version: 8 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -15,9 +15,13 @@ description: The following analytic detects attempts to dump the LSASS process m data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* - | stats count min(_time) as firstTime max(_time) as lastTime by dest, TargetImage, - TargetProcessId, SourceImage, SourceProcessId | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID + GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec + parent_process_guid parent_process_id parent_process_name parent_process_path process_exec + process_guid process_id process_name process_path signature signature_id user_id + vendor_product | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `access_lsass_memory_for_dump_creation_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations @@ -69,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 08adcce445..113983dcc4 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,6 +1,6 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed - Components*") BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.dest Registry.user | - `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `active_setup_registry_autostart_filter`' + Components*") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 968de4b132..10c68a4f28 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,6 +1,6 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -15,13 +15,15 @@ description: The following analytic detects suspicious registry modifications th to maintain persistence and further encrypt the network, leading to significant data loss and operational disruption. data_source: +- Sysmon EventID 12 - Sysmon EventID 13 -- Sysmon EventID 14 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword - OR Registry.registry_value_name= DefaultUserName) BY Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest Registry.registry_value_data Registry.process_guid + OR Registry.registry_value_name= DefaultUserName) by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index ca4975ede6..a3d83c5802 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -1,6 +1,6 @@ name: Add or Set Windows Defender Exclusion id: 773b66fe-4dd9-11ec-8289-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference *" OR Processes.process = "*Set-MpPreference *") AND Processes.process="*-exclusion*" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `add_or_set_windows_defender_exclusion_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `add_or_set_windows_defender_exclusion_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 67241b0279..41f5c440cd 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -1,6 +1,6 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the use of the `[Adsisearcher]` type data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText - = "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Computer ScriptBlockText UserID - | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`' + = "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id + vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -29,13 +29,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -43,13 +43,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Powershell process having commandline "AdsiSearcher" used for user enumeration - on $dest$ + message: Powershell process have been used for user enumeration on $dest$ risk_objects: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -70,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 2e11a3aa86..6ac732cc41 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -1,6 +1,6 @@ name: Allow File And Printing Sharing In Firewall id: ce27646e-d411-11eb-8a00-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process= "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*" Processes.process="*enable=Yes*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `allow_file_and_printing_sharing_in_firewall_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index cf409551e6..797b4f6683 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,6 +1,6 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = - "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.dest Registry.user | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`' + "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `allow_inbound_traffic_by_firewall_rule_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index bf2fda0d4b..4af28169e5 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -1,6 +1,6 @@ name: Allow Inbound Traffic In Firewall Rule id: a5d85486-b89c-11eb-8267-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects a suspicious PowerShell command that data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*firewall*" ScriptBlockText - = "*Inbound*" ScriptBlockText = "*Allow*" ScriptBlockText = "*-LocalPort*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`' + = "*Inbound*" ScriptBlockText = "*Allow*" ScriptBlockText = "*-LocalPort*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -27,12 +27,12 @@ known_false_positives: administrator may allow inbound traffic in certain networ references: - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -41,9 +41,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious firewall modification detected on endpoint $dest$ by user $user$. + message: Suspicious firewall modification detected on endpoint $dest$ by user $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 3 - field: dest @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 1163a4d168..8e31c586cf 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -1,6 +1,6 @@ name: Allow Network Discovery In Firewall id: ccd6a38c-d40b-11eb-85a5-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,9 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process= "*firewall*" Processes.process= "*group=\"Network Discovery\"*" Processes.process="*enable*" - Processes.process="*Yes*" by Processes.dest Processes.user Processes.parent_process - Processes.original_file_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` + Processes.process="*Yes*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 626b794c8b..aaa4de15a7 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,6 +1,6 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 9 +version: 10 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -19,10 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data - = "0x00000000") BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.dest Registry.user | - `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `allow_operation_with_consent_admin_filter`' + = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -73,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 32a9f2d25c..49c4dd5633 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -1,6 +1,6 @@ name: Anomalous usage of 7zip id: 9364ee8e-a39a-11eb-8f1d-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.dest - Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`' + IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `anomalous_usage_of_7zip_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 0cee497f25..b17b566403 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,7 +1,7 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: '12' -date: '2025-02-24' +version: 13 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: TTP @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile* - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.parent_process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `any_powershell_downloadfile_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,6 +86,7 @@ tags: - PXA Stealer - Data Destruction - Log4Shell CVE-2021-44228 + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint cve: - CVE-2021-44228 diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 7f516361ff..0d81340cfa 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -1,6 +1,6 @@ name: Any Powershell DownloadString id: 4d015ef2-7adf-11eb-95da-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,11 +18,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString* by - Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString* + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `any_powershell_downloadstring_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,6 +84,7 @@ tags: - IcedID - SysAid On-Prem Software CVE-2023-47246 Vulnerability - Phemedrone Stealer + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint mitre_attack_id: - T1059.001 @@ -93,7 +97,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index b4a9c676c9..5cd7bd05a6 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,7 +1,7 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 9 -date: '2025-02-27' +version: 10 +date: '2025-03-27' author: Bhavin Patel, Splunk status: production type: TTP @@ -20,10 +20,15 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown - Processes.user!=unknown by Processes.dest Processes.user Processes.process_name - Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS - process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`' + Processes.user!=unknown by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup + attacker_tools attacker_tool_names AS process_name OUTPUT description | search description + !=false| `attacker_tools_on_endpoint_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,6 +75,7 @@ tags: - SamSam Ransomware - CISA AA22-264A - Compromised Windows Host + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint mitre_attack_id: - T1003 @@ -83,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 360d6c472d..0cc6ac4dfa 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -1,6 +1,6 @@ name: Attempt To Add Certificate To Untrusted Store id: 6bc5243e-ef36-45dc-9b12-f4a6be131159 -version: 13 +version: 14 date: '2025-02-10' author: Patrick Bareiss, Rico Valdez, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` - (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`' + (Processes.process=*-addstore*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 193fe03dd9..473a043c49 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -1,6 +1,6 @@ name: Auto Admin Logon Registry Entry id: 1379d2b8-0f18-11ec-8ca3-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -19,10 +19,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND - Registry.registry_value_data=1) BY Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.dest | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' + Registry.registry_value_data=1) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `auto_admin_logon_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 0d3a9702cd..bfbb21c1f7 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -1,6 +1,6 @@ name: Batch File Write to System32 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -version: 9 +version: 10 date: '2025-02-10' author: Steven Dick, Michael Haag, Rico Valdez, Splunk status: production @@ -14,17 +14,16 @@ description: The following analytic detects the creation of a batch file (.bat) to execute arbitrary commands with elevated privileges, potentially compromising the entire system. data_source: -- Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=* by _time span=1h Processes.process_guid Processes.process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | join process_guid - [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*", - "*\\syswow64\\*") Filesystem.file_name="*.bat" by _time span=1h Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid - | `drop_dm_object_name(Filesystem)`] | table dest user file_create_time, file_name, - file_path, process_name, firstTime, lastTime | dedup file_create_time | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `batch_file_write_to_system32_filter`' +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path IN ("*\\system32\\*","*\\syswow64\\*") Filesystem.file_name="*.bat" + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `batch_file_write_to_system32_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index d8c602f6b4..282a6e53ac 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -1,7 +1,7 @@ name: Bcdedit Command Back To Normal Mode Boot id: dc7a8004-0f18-11ec-8c54-acde48001122 -version: '5' -date: '2025-03-03' +version: 6 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" - by Processes.process_name Processes.process Processes.parent_process_name Processes.dest - Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `bcdedit_command_back_to_normal_mode_boot_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 1425eee424..bb8b6ece86 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -1,6 +1,6 @@ name: BCDEdit Failure Recovery Modification id: 809b31d2-5462-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe - Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name - Processes.process Processes.parent_process_name Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index eee12eeb44..a223637f63 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -1,6 +1,6 @@ name: BITS Job Persistence id: e97a5ffe-90bf-11eb-928a-acde48001122 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -20,9 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, - *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.original_file_name - Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + *setcustomheaders*, *resume* ) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -85,13 +88,11 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log source: crowdstrike sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index bdab9e207a..20d4f3027f 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -1,6 +1,6 @@ name: BITSAdmin Download File id: 80630ff4-8e4c-11eb-aab5-acde48001122 -version: 8 +version: 9 date: '2024-11-13' author: Michael Haag, Sittikorn S status: production @@ -20,9 +20,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process - IN ("*transfer*", "*addfile*") by Processes.dest Processes.user Processes.parent_process - Processes.parent_process_name Processes.original_file_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + IN ("*transfer*", "*addfile*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -89,13 +92,11 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log source: crowdstrike sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index b6d19b0b39..e1fb2a7acf 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -1,6 +1,6 @@ name: CertUtil Download With URLCache and Split Arguments id: 415b4306-8bfb-11eb-85c4-acde48001122 -version: 10 +version: 11 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process="*urlcache*" - (Processes.process="*/f *" OR Processes.process="*-f *") by Processes.dest Processes.user - Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.original_file_name Processes.parent_process_id | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + (Processes.process="*/f *" OR Processes.process="*-f *") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -90,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 97a0c24ba9..c2fb4097f7 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -1,6 +1,6 @@ name: CertUtil Download With VerifyCtl and Split Arguments id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -version: 10 +version: 11 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process="*verifyctl*" - (Processes.process="*/f *" OR Processes.process="*-f *") by Processes.dest Processes.user - Processes.original_file_name Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + (Processes.process="*/f *" OR Processes.process="*-f *") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -87,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 6dafec9ff9..0c8b7efd41 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -1,6 +1,6 @@ name: Certutil exe certificate extraction id: 337a46be-600f-11eb-ae93-0242ac130002 -version: 8 +version: 9 date: '2024-12-10' author: Rod Soto, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe - Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' + Processes.process = "*-exportPFX*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index f00b0f4387..d787db6738 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -1,6 +1,6 @@ name: CertUtil With Decode Argument id: bfe94226-8c10-11eb-a4b3-acde48001122 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode* - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -90,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index 75247f707c..29d3da2b0f 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -1,7 +1,7 @@ name: Change To Safe Mode With Network Config id: 81f1dce0-0f18-11ec-a5d7-acde48001122 -version: '5' -date: '2025-03-03' +version: 6 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" - Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name - Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`' + Processes.process="*network*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index ea4772bb28..e24a0ed294 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -1,6 +1,6 @@ name: CHCP Command Execution id: 21d236ec-eec1-11eb-b23e-acde48001122 -version: 5 +version: 6 date: '2025-02-19' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) - by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process - Processes.process_id Processes.parent_process_id Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index b5f5648875..2921928934 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -1,6 +1,6 @@ name: Check Elevated CMD using whoami id: a9079b18-1633-11ec-859c-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*whoami*" Processes.process = "*/group*" Processes.process = "* find *" Processes.process - = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`' + = "*12288*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `check_elevated_cmd_using_whoami_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/endpoint/child_processes_of_spoolsv_exe.yml index b43429e414..946cceb192 100644 --- a/detections/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/endpoint/child_processes_of_spoolsv_exe.yml @@ -1,6 +1,6 @@ name: Child Processes of Spoolsv exe id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -version: 6 +version: 7 date: '2024-11-13' author: Rico Valdez, Splunk status: experimental @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe - AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter`' + AND Processes.process_name!=regsvr32.exe by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index 82a73a420c..bed58ac26b 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -1,6 +1,6 @@ name: Clear Unallocated Sector Using Cipher App id: cd80a6ac-c9d9-11eb-8839-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe" - Processes.process = "*/w:*" by Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`' + Processes.process = "*/w:*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 3618dec57d..a3dc5b4db9 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Clop Common Exec Parameter id: 5a8a2a72-8322-11eb-9ee9-acde48001122 -version: 8 +version: 9 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" - Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest - Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`' + Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `clop_common_exec_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_b/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_b/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index f2545358d1..cbb0067a2b 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -1,6 +1,6 @@ name: CMD Carry Out String Command Parameter id: 54a6ed00-3256-11ec-b031-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Teoderick Contreras, Bhavin Patel, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="* - /c*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`' + /c*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `cmd_carry_out_string_command_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/cmd_carry_str_param/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index c1b77e4c5b..1a970695c8 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -1,6 +1,6 @@ name: CMD Echo Pipe - Escalation id: eb277ba0-b96b-11eb-b00e-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR Processes.process=*%comspec%* - (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user - Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`' + (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `cmd_echo_pipe___escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index deb0daab75..1b3b8140a7 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -1,6 +1,6 @@ name: CMLUA Or CMSTPLUA UAC Bypass id: f87b5062-b405-11eb-a889-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", - "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime - by dest Image ImageLoaded process_name EventCode Signed ProcessId | `security_content_ctime(firstTime)` + "*\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 85ae717a21..acadb477f9 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -1,6 +1,6 @@ name: Cobalt Strike Named Pipes id: 5876d429-0240-4709-8b93-ea8330b411b5 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,8 +18,9 @@ data_source: - Sysmon EventID 18 search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*, \\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, - \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime - by dest, process_name, process_id process_path, PipeName | `security_content_ctime(firstTime)` + \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime + by dest dvc pipe_name process_exec process_guid process_id process_name process_path + signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -79,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 14195a6871..c2ed660695 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,7 +1,7 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: '13' -date: '2025-03-25' +version: 13 +date: '2025-03-27' author: David Dorsey, Michael Haag, Splunk, Steven Dick status: production type: TTP @@ -17,13 +17,21 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime count latest(Filesystem.user) as user values(Filesystem.file_path) as - file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest - _time span=1h | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?\.[^\.]+)$" - | rex field=file_path "(?([^\\\]*\\\)*).*" | stats min(firstTime) - as firstTime max(lastTime) as lastTime latest(user) as user dc(true_file_path) as - path_count dc(file_name) as file_count latest(true_file_path) as file_path by dest - file_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `ransomware_extensions` | where path_count > 1 OR file_count > 20 | `common_ransomware_extensions_filter`' + file_path from datamodel=Endpoint.Filesystem by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?\.[^\.]+)$" + | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT + Extensions Name | search Name !=False | stats min(firstTime) as firstTime max(lastTime) + as lastTime dc(file_path) as path_count dc(file_name) as file_count values(action) + as action values(file_access_time) as file_access_time values(file_create_time) + as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time + values(file_acl) as file_acl values(file_size) as file_size values(process_guid) + as process_guid values(process_id) as process_id values(user) as user values(vendor_product) + as vendor_product values(file_name) as file_name values(file_extension) as file_extension values(Name) as Name by dest + | where path_count > 1 OR file_count > 20 + | `common_ransomware_extensions_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data model node. To see the additional metadata, add the following fields, if not already present, please review @@ -34,13 +42,13 @@ known_false_positives: It is possible for a legitimate file with these extension references: - https://github.com/splunk/security_content/issues/2448 drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime +- name: View risk events for the last 7 days for "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` @@ -49,7 +57,7 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with - the $Extensions$ extension. This extension and behavior may indicate a $Name$ + the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack. risk_objects: - field: user diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 069996fda3..d8fa6bb2c3 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -1,7 +1,7 @@ name: Common Ransomware Notes id: ada0f478-84a8-4641-a3f1-d82362d6bd71 -version: '8' -date: '2025-03-03' +version: 9 +date: '2025-03-27' author: David Dorsey, Splunk status: production type: Hunting @@ -16,9 +16,12 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) - as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` - | `common_ransomware_notes_filter`' + as file_path from datamodel=Endpoint.Filesystem by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `ransomware_notes` | `common_ransomware_notes_filter`' how_to_implement: You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or diff --git a/detections/endpoint/connectwise_screenconnect_path_traversal.yml b/detections/endpoint/connectwise_screenconnect_path_traversal.yml index abdafa951b..1b15ea96bd 100644 --- a/detections/endpoint/connectwise_screenconnect_path_traversal.yml +++ b/detections/endpoint/connectwise_screenconnect_path_traversal.yml @@ -18,8 +18,10 @@ description: The following analytic detects attempts to exploit the ConnectWise a severe security risk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\ScreenConnect\\App_Extensions\\*") - Filesystem.file_name IN ("*.aspx","*.ashx") by Filesystem.file_create_time Filesystem.process_id - Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.dest + Filesystem.file_name IN ("*.aspx","*.ashx") by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `connectwise_screenconnect_path_traversal_filter`' how_to_implement: This analytic utilizes the Endpoint datamodel Filesystem node to @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 68ddb073f8..96760dea35 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Conti Common Exec parameter id: 624919bc-c382-11eb-adcc-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process - = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name - Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + = "*-nomutex*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `conti_common_exec_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 34c0fe2491..7997499fba 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -1,6 +1,6 @@ name: Control Loading from World Writable Directory id: 10423ac4-10c9-11ec-8dc4-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*", - "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`' + "*\\windows\\temp\\*", "*\\programdata\\*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -89,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 43cc11f1f7..cba2a526d6 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -1,6 +1,6 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c -version: 12 +version: 13 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -21,10 +21,14 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by - Processes.process Processes.process_name Processes.parent_process_name Processes.original_file_name - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | search process IN ("*share* /delete*", "*share* - /REMARK:*", "*share* /CACHE:*") | `create_or_delete_windows_shares_using_net_exe_filter`' + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | search process IN ("*share* /delete*", "*share* /REMARK:*", "*share* /CACHE:*") + | `create_or_delete_windows_shares_using_net_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 5a9e5a6de1..c11da36f0a 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -1,6 +1,6 @@ name: Create Remote Thread In Shell Application id: 10399c1e-f51e-11eb-b920-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,12 @@ description: The following analytic detects suspicious process injection in comm data_source: - Sysmon EventID 8 search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*", "*\\pwsh.exe") - | stats count min(_time) as firstTime max(_time) as lastTime by TargetImage TargetProcessId - SourceProcessId EventCode StartAddress SourceImage dest |rename SourceImage as - process_name| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId + ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress + StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest + parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path + process_exec process_guid process_id process_name process_path signature signature_id + user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -67,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index fbc0310759..2d022e8a2b 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -1,6 +1,6 @@ name: Create Remote Thread into LSASS id: 67d4dbef-9564-4699-8da8-03a151529edc -version: 7 +version: 8 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -16,8 +16,12 @@ description: The following analytic detects the creation of a remote thread in t data_source: - Sysmon EventID 8 search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime - max(_time) as lastTime by dest, EventCode, TargetImage, TargetProcessId | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter`' + max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage + SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage + TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process_exec process_guid + process_id process_name process_path signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter`' how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations @@ -67,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 2a7706b86a..69b728d266 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -15,9 +15,9 @@ description: The following analytic detects the creation of an lsass.exe process data_source: - Sysmon EventID 11 search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp | - stats count min(_time) as firstTime max(_time) as lastTime by dest, object_category, - process_name, TargetFilename | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `creation_of_lsass_dump_with_taskmgr_filter`' + stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name + file_path process_guid process_id user_id vendor_product process_name TargetFilename | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific @@ -68,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index ce5b148d77..a3ec742a46 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -1,6 +1,6 @@ name: Creation of Shadow Copy id: eb120f5f-b879-4a63-97c1-93352b5df844 -version: 7 +version: 8 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe - Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user - Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`' + Processes.process=*shadowcopy* Processes.process=*create*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `creation_of_shadow_copy_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,13 +86,11 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log source: crowdstrike sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 78b7c0d9dd..8f46b39247 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -1,6 +1,6 @@ name: Creation of Shadow Copy with wmic and powershell id: 2ed8b538-d284-449a-be1d-82ad1dbd186b -version: 9 +version: 10 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -19,8 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell` - Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name - Processes.original_file_name Processes.parent_process_name Processes.process Processes.dest + Processes.process=*shadowcopy* Processes.process=*create* by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index a443947f7e..68b426ca73 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -1,6 +1,6 @@ name: Credential Dumping via Copy Command from Shadow Copy id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b -version: 7 +version: 8 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -20,9 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system* - OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.dest Processes.user - Processes.process_name Processes.process Processes.parent_process Processes.original_file_name - Processes.process_id Processes.parent_process_id Processes.parent_process_name + OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index ac524c6b29..85b4a297cf 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -1,6 +1,6 @@ name: Credential Dumping via Symlink to Shadow Copy id: c5eac648-fae0-4263-91a6-773df1f4c903 -version: 7 +version: 8 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -20,10 +20,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink* - Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name - Processes.process Processes.parent_process Processes.parent_process_name Processes.original_file_name - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`' + Processes.process=*HarddiskVolumeShadowCopy* by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `credential_dumping_via_symlink_to_shadow_copy_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml index 39211a947c..34cc953708 100644 --- a/detections/endpoint/csc_net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -1,6 +1,6 @@ name: CSC Net On The Fly Compilation id: ea73128a-43ab-11ec-9753-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_csc` Processes.process = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" by - Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `csc_net_on_the_fly_compilation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -53,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 0fd2ed2163..58a9d66e17 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -1,6 +1,6 @@ name: Curl Download and Bash Execution id: 900bc324-59f3-11ec-9fb4-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk, DipsyTipsy status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl (Processes.process="*-s *") AND (Processes.process="*|*" AND Processes.process="*bash*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `curl_download_and_bash_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -88,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 9e9208a89a..f4818dc3e7 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -15,10 +15,10 @@ description: The following analytic detects the use of PowerShell to delete shad data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText - = "*Delete*" OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime - max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText |rename - Computer as dest |rename UserID as user | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' + = "*Delete*" OR ScriptBlockText = "*Remove*") | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product + EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -27,12 +27,12 @@ references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -42,9 +42,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: An attempt to delete ShadowCopy was performed using PowerShell on $dest$ - by $user$. + by $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 81 - field: dest @@ -69,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 10f73b29f8..87d92740f1 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -21,8 +21,12 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow* - by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `deleting_shadow_copies_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index df661b9c10..b174064306 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect AzureHound Command-Line Arguments id: 26f02e96-c300-11eb-b611-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,8 +18,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -85,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index af89e009cd..9917d12d16 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -1,6 +1,6 @@ name: Detect AzureHound File Modifications id: 1c34549e-c31b-11eb-996b-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,8 +18,10 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", - "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.dest Filesystem.user | `drop_dm_object_name(Filesystem)` + "*-azapplicationadmins.json") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible @@ -75,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_certify_command_line_arguments.yml b/detections/endpoint/detect_certify_command_line_arguments.yml index ac2d074956..7cf359cb5b 100644 --- a/detections/endpoint/detect_certify_command_line_arguments.yml +++ b/detections/endpoint/detect_certify_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect Certify Command Line Arguments id: e6d2dc61-a8b9-4b03-906c-da0ca75d71b8 -version: 5 +version: 6 date: '2024-12-10' author: Steven Dick status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("* find *","* auth *","* request *","* req *","* download *",) AND Processes.process IN ("* /vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*","* /ca*", "* - -username *","* -u *") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `detect_certify_command_line_arguments_filter`' + -username *","* -u *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `detect_certify_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml index 5b22224e3d..04398a2116 100644 --- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml @@ -1,6 +1,6 @@ name: Detect Certify With PowerShell Script Block Logging id: f533ca6c-9440-4686-80cb-7f294c07812a -version: 6 +version: 7 date: '2025-02-10' author: Steven Dick status: production @@ -19,12 +19,11 @@ search: '`powershell` EventCode=4104 (ScriptBlockText IN ("*find *") AND ScriptB IN ("* /vulnerable*","* -vulnerable*","* /enrolleeSuppliesSubject *","* /json /outfile*")) OR (ScriptBlockText IN (,"*auth *","*req *",) AND ScriptBlockText IN ("* -ca *","* -username *","* -u *")) OR (ScriptBlockText IN ("*request *","*download *") AND - ScriptBlockText IN ("* /ca:*")) | stats count min(_time) as firstTime max(_time) - as lastTime list(ScriptBlockText) as command Values(OpCode) as reason values(Path) - as file_name values(UserID) as user by _time Computer EventCode | `security_content_ctime(firstTime)` + ScriptBlockText IN ("* /ca:*")) | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval file_name = case(isnotnull(file_name),file_name,true(),"unknown") - | eval signature = substr(command,0,256) | rename Computer as dest,EventCode as - signature_id | `detect_certify_with_powershell_script_block_logging_filter`' + | eval signature = substr(command,0,256) | `detect_certify_with_powershell_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.. @@ -33,13 +32,13 @@ references: - https://github.com/GhostPack/Certify - https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -52,7 +51,7 @@ rba: - field: dest type: system score: 90 - - field: user + - field: user_id type: user score: 90 threat_objects: [] @@ -72,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml index 48a6a3129b..7706d5ec81 100644 --- a/detections/endpoint/detect_certipy_file_modifications.yml +++ b/detections/endpoint/detect_certipy_file_modifications.yml @@ -1,6 +1,6 @@ name: Detect Certipy File Modifications id: 7e3df743-b1d8-4631-8fa8-bd5819688876 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick status: production @@ -14,21 +14,15 @@ description: The following analytic detects the use of the Certipy tool to enume malicious, this could lead to unauthorized access to sensitive AD CS information, enabling further attacks or privilege escalation within the network. data_source: -- Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime values(Processes.process_current_directory) as process_current_directory - FROM datamodel=Endpoint.Processes where Processes.action="allowed" BY _time span=1h - Processes.user Processes.dest Processes.process_id Processes.process_name Processes.process - Processes.process_path Processes.parent_process_name Processes.parent_process Processes.process_guid - Processes.action |`drop_dm_object_name(Processes)` | join max=0 dest process_guid - [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*_certipy.zip", - "*_certipy.txt", "*_certipy.json", "*.ccache") by Filesystem.file_create_time Filesystem.process_id - Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.dest - | `drop_dm_object_name(Filesystem)` ] | fields firstTime lastTime user dest file_create_time - file_name file_path parent_process_name parent_process process_name process_path - process_current_directory process process_guid process_id | where isnotnull(file_name) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_certipy_file_modifications_filter`' +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from + datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*_certipy.zip","*_certipy.txt", "*_certipy.json", "*.ccache") + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_certipy_file_modifications_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints as well as file creation or deletion events. @@ -61,8 +55,6 @@ rba: threat_objects: - field: file_name type: file_name - - field: process_name - type: process_name tags: analytic_story: - Windows Certificate Services diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index 0b55a03dbe..0da8ae363c 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -1,6 +1,6 @@ name: Detect Computer Changed with Anonymous Account id: 1400624a-d42d-484d-8843-e6753e6e3645 -version: 5 +version: 6 date: '2024-11-13' author: Rod Soto, Jose Hernandez, Splunk status: experimental @@ -16,8 +16,10 @@ data_source: - Windows Event Log Security 4624 - Windows Event Log Security 4742 search: '`wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS - LOGON" LogonType=3 | stats count values(host) as host, values(TargetDomainName) - as Domain, values(user) as user | `detect_computer_changed_with_anonymous_account_filter`' + LOGON" LogonType=3 | stats count min(_time) as firstTime max(_time) as lastTime + by action app authentication_method dest dvc process process_id process_name process_path + signature signature_id src src_port status subject user user_group vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_computer_changed_with_anonymous_account_filter`' how_to_implement: This search requires audit computer account management to be enabled on the system in order to generate Event ID 4742. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index 0cf2e7f6aa..a4c458f7ab 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -16,9 +16,10 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*copy*","*[System.IO.File]::Copy*") AND ScriptBlockText IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename Computer as dest | rename UserID as user - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_copy_of_shadowcopy_with_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -29,12 +30,12 @@ references: - https://github.com/GossiTheDog/HiveNightmare - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -44,9 +45,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: PowerShell was identified running a script to capture the SAM hive on endpoint - $dest$ by user $user$. + $dest$ by user $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 80 - field: dest @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index d407bbd637..7731eec61f 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -1,6 +1,6 @@ name: Detect Credential Dumping through LSASS access id: 2c365e57-4414-4540-8dc0-73ab10729996 -version: 7 +version: 8 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -16,9 +16,13 @@ description: The following analytic detects attempts to read LSASS memory, indic data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) - | stats count min(_time) as firstTime max(_time) as lastTime by dest, SourceImage, - SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `detect_credential_dumping_through_lsass_access_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID + GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec + parent_process_guid parent_process_id parent_process_name parent_process_path process_exec + process_guid process_id process_name process_path signature signature_id user_id + vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_credential_dumping_through_lsass_access_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations @@ -69,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index 4c5e71523a..422a44ca2c 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -1,6 +1,6 @@ name: Detect Empire with PowerShell Script Block Logging id: bc1dc6b8-c954-11eb-bade-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects suspicious PowerShell execution indi data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText=*system.net.webclient* AND - ScriptBlockText=*frombase64string*) | stats count min(_time) as firstTime max(_time) - as lastTime by Opcode Computer UserID EventCode ScriptBlockText | rename UserID - as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_empire_with_powershell_script_block_logging_filter`' + ScriptBlockText=*frombase64string*) | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_empire_with_powershell_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -49,12 +49,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: The following behavior was identified and typically related to PowerShell-Empire - on $Computer$ by $user$. + on $dest$ by $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 81 - - field: Computer + - field: dest type: system score: 81 threat_objects: [] @@ -74,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 88759b8cbe..1dc25eace0 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -14,18 +14,16 @@ description: The following analytic identifies the creation of suspicious .aspx attackers could gain unauthorized access, execute arbitrary commands, and potentially escalate privileges within the Exchange environment. data_source: -- Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=System by _time span=1h Processes.process_guid Processes.process_name - Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path - IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") - Filesystem.file_name IN( "*.aspx", "*.ashx") by _time span=1h Filesystem.process_guid - Filesystem.user Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path | `drop_dm_object_name(Filesystem)` ] | dedup file_create_time - | table _time dest user file_create_time file_name file_path process_name process - process_guid | `detect_exchange_web_shell_filter`' +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") + Filesystem.file_name IN( "*.aspx", "*.ashx") + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_exchange_web_shell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index a772c50bad..ba01055d7a 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -1,6 +1,6 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=hh.exe - AND Processes.original_file_name=HH.EXE by Processes.dest Processes.user Processes.parent_process_name - Processes.original_file_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' + AND Processes.original_file_name=HH.EXE by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -53,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 4e07b994f9..d4b5b7b318 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process=*http* - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.original_file_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_html_help_url_in_command_line_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_html_help_url_in_command_line_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -86,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 3ab1a666ab..debacbc490 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -1,6 +1,6 @@ name: Detect HTML Help Using InfoTech Storage Handlers id: 0b2eefa5-5508-450d-b970-3dd2fb761aec -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process - IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_html_help_using_infotech_storage_handlers_filter`' + IN ("*its:*", "*mk:@MSITStore:*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index d3616fae42..31718bff40 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -1,6 +1,6 @@ name: Detect Mimikatz With PowerShell Script Block Logging id: 8148c29c-c952-11eb-9255-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the execution of Mimikatz commands v data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, - *kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time) - as lastTime by Opcode Computer UserID EventCode ScriptBlockText | rename UserID - as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_mimikatz_with_powershell_script_block_logging_filter`' + *kerberos::ptt*, *kerberos::golden*) | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -47,12 +47,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: The following behavior was identified and typically related to MimiKatz - being loaded within the context of PowerShell on $Computer$ by $user$. + being loaded within the context of PowerShell on $dest$ by $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 90 - - field: Computer + - field: dest type: system score: 90 threat_objects: [] @@ -77,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index cc64c91a1d..eb1250df05 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -1,6 +1,6 @@ name: Detect mshta inline hta execution id: a0873b32-5b68-11eb-ae93-0242ac130002 -version: 14 +version: 15 date: '2025-02-10' author: Bhavin Patel, Michael Haag, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta` (Processes.process=*vbscript* - OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user - Processes.process_name Processes.original_file_name Processes.parent_process_name - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `detect_mshta_inline_hta_execution_filter`' + OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `detect_mshta_inline_hta_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -86,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 8edd8c5256..5e9ed9f6d3 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -1,6 +1,6 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=mshta.exe - AND Processes.original_file_name=MSHTA.EXE by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter`' + AND Processes.original_file_name=MSHTA.EXE by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index c33a2bd047..f5588bf53f 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 10 +version: 11 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,12 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta` (Processes.process="*http://*" - OR Processes.process="*https://*") by Processes.user Processes.process_name Processes.parent_process_name - Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)` + OR Processes.process="*https://*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -86,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 95d80c9749..75d969f3d3 100644 --- a/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -1,6 +1,6 @@ name: Detect Outlook exe writing a zip file id: a51bfe1a-94f0-4822-b1e4-16ae10145893 -version: 10 +version: 11 date: '2025-02-10' author: Bhavin Patel, Splunk status: experimental @@ -14,21 +14,38 @@ description: The following analytic identifies the execution of `outlook.exe` wr the security of the affected system and network. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe - by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest - Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename - process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id - type=inner[| tstats `security_content_summariesonly` count values(Filesystem.file_path) - as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*.zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* - OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash - Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | rename process_id as malicious_id| fields - malicious_id outlook_id dest file_path file_name file_hash count file_id] | table - firstTime lastTime user malicious_id outlook_id process_name parent_process_name - file_name file_path | where file_name != "" | `detect_outlook_exe_writing_a_zip_file_filter`' + OR Filesystem.file_path=*Local\\Temp*) by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(parent_process) as parent_process values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(file_access_time) as file_access_time values(file_create_time) + as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time + values(file_name) as file_name values(file_path) as file_path values(file_acl) as + file_acl values(file_size) as file_size by process_guid | where isnotnull(process) + AND isnotnull(file_name) | `detect_outlook_exe_writing_a_zip_file_filter`' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data diff --git a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml index f3fb364f2a..9400cb9938 100644 --- a/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml +++ b/detections/endpoint/detect_password_spray_attack_behavior_from_source.yml @@ -1,7 +1,7 @@ name: Detect Password Spray Attack Behavior From Source id: b6391b15-e913-4c2c-8949-9eecc06efacc -version: 5 -date: '2025-02-10' +version: 6 +date: '2025-03-27' author: Steven Dick status: production type: TTP @@ -18,8 +18,9 @@ data_source: search: '| tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication - where * by Authentication.action,Authentication.src,Authentication.user | `drop_dm_object_name("Authentication")` - | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), + by Authentication.action Authentication.app Authentication.authentication_method + Authentication.dest Authentication.signature Authentication.signature_id Authentication.src + Authentication.user | `drop_dm_object_name("Authentication")` | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), src=upper(src), success=if(action="success",count,0),success_user=if(action="success",user,null),failure=if(action="failure",count,0), failed_user=if(action="failure",user,null) | `detect_password_spray_attack_behavior_from_source_filter` | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) @@ -77,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml index f6ebd68a48..b3a471d221 100644 --- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml +++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml @@ -1,7 +1,7 @@ name: Detect Password Spray Attack Behavior On User id: a7539705-7183-4a12-9b6a-b6eef645a6d7 -version: 5 -date: '2025-02-10' +version: 6 +date: '2025-03-27' author: Steven Dick status: production type: TTP @@ -17,8 +17,9 @@ data_source: search: '| tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication - where * by Authentication.action,Authentication.src,Authentication.user | `drop_dm_object_name("Authentication")` - | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), + by Authentication.action Authentication.app Authentication.authentication_method + Authentication.dest Authentication.signature Authentication.signature_id Authentication.src + Authentication.user | `drop_dm_object_name("Authentication")` | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), success=if(action="success",count,0), src=upper(src), success_src=if(action="success",src,null), failure=if(action="failure",count,0), failed_src=if(action="failure",src,null) | `detect_password_spray_attack_behavior_on_user_filter` | stats count min(firstTime) @@ -78,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 7996dfb15e..218c1b6110 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -1,6 +1,6 @@ name: Detect Path Interception By Creation Of program exe id: cbef820c-e1ff-407f-887f-0a9240a2d477 -version: 11 +version: 12 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -19,8 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe - by Processes.user Processes.process_name Processes.parent_process_name Processes.process - Processes.dest | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`' @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index 1b9df60d0d..66336a4c7f 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,6 +1,6 @@ name: Detect Prohibited Applications Spawning cmd exe id: dcfd6b40-42f9-469d-a433-2e53f7486664 -version: 11 +version: 12 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd_macro`] - | `detect_prohibited_applications_spawning_cmd_exe_filter`' + where `process_cmd` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |search + [`prohibited_apps_launching_cmd_macro`] | `detect_prohibited_applications_spawning_cmd_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -53,7 +57,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index ebb7534c48..9ae14a53c0 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_psexec` Processes.process=*accepteula* by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`' + where `process_psexec` Processes.process=*accepteula* by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `detect_psexec_with_accepteula_flag_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -94,7 +98,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index a19ca4ff86..caa455178d 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -1,7 +1,7 @@ name: Detect Rare Executables id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac -version: '8' -date: '2025-02-07' +version: 9 +date: '2025-03-27' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -19,9 +19,19 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` dc(Processes.dest) as dc_dest values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes by Processes.process_name | `drop_dm_object_name(Processes)` - | search dc_dest < 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_rare_executables_filter`' + values(Processes.action) as action values(Processes.original_file_name) as original_file_name + values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) + as parent_process_name values(Processes.parent_process_path) as parent_process_path + values(Processes.process) as process values(Processes.process_exec) as process_exec + values(Processes.process_guid) as process_guid values(Processes.process_hash) as + process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) + as user_id values(Processes.vendor_product) as vendor_product from datamodel=Endpoint.Processes + by Processes.process_name | `drop_dm_object_name(Processes)` | search dc_dest < + 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | + `detect_rare_executables_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index d5dae5c8af..0cca827775 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,7 +1,7 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: '8' -date: '2025-03-03' +version: '9' +date: '2025-03-27' author: Michael Haag, Splunk status: production type: TTP @@ -20,9 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", - "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by - Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index adc6c5a181..6775ddf818 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Detect Regasm Spawning a Process id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f -version: 10 +version: 11 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe - NOT (Processes.process_name IN ("conhost.exe")) by Processes.dest Processes.user - Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter`' + NOT (Processes.process_name IN ("conhost.exe")) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_regasm_spawning_a_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -90,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index 803e1d2cc8..a2933b40f0 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -1,6 +1,6 @@ name: Detect Regasm with Network Connection id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,9 +15,11 @@ description: The following analytic detects the execution of regasm.exe establis data_source: - Sysmon EventID 3 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/8 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 - process_name=regasm.exe | stats count min(_time) as firstTime max(_time) as lastTime - by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`' + process_name=regasm.exe | stats count min(_time) as firstTime max(_time) as lastTime + by action app dest dest_ip dest_port direction dvc protocol protocol_version src + src_ip src_port transport user vendor_product process_name process_exec process_guid + process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_regasm_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index a04e5c72a0..fe1d72e8a7 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect Regasm with no Command Line Arguments id: c3bc1430-04e7-4178-835f-047d8e6e97df -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_regasm` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`' + where `process_regasm` by _time span=1h Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex + process="(?i)(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 72541a45bc..eff567a17e 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Detect Regsvcs Spawning a Process id: bc477b57-5c21-4ab6-9c33-668772e7f114 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,8 +20,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regsvcs.exe - by Processes.parent_process_name Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -85,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index 160e0aad1e..0deeab2e7f 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -1,6 +1,6 @@ name: Detect Regsvcs with Network Connection id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -17,8 +17,10 @@ data_source: - Sysmon EventID 3 search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/8 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe | stats count min(_time) as firstTime max(_time) as lastTime - by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`' + by action app dest dest_ip dest_port direction dvc protocol protocol_version src + src_ip src_port transport user vendor_product process_name process_exec process_guid + process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_regsvcs_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 79f0ca5b7e..87a36d76dd 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect Regsvcs with No Command Line Arguments id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -17,9 +17,13 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_regsvcs` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where `process_regsvcs` by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index a3df354b36..b3d324c254 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -1,6 +1,6 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*scrobj* - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.parent_process_name Processes.process Processes.original_file_name Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `detect_regsvr32_application_control_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,6 +80,7 @@ tags: - Cobalt Strike - Compromised Windows Host - BlackByte Ransomware + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint mitre_attack_id: - T1218.010 @@ -88,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index ea2a8f4d1b..7862036874 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -17,7 +17,10 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count, min(_time) as firstTime, max(_time) as lastTime, values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem - by Filesystem.dest, Filesystem.user, Filesystem.file_name | `security_content_ctime(firstTime)` + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Filesystem)` | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` @@ -54,7 +57,7 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate files on $dest$ +- name: Investigate files on $dest$ search: '| from datamodel:Endpoint.Filesystem | search dest=$dest$ file_name=$file_name$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -94,7 +97,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 7e020435cd..1c62ce1b0b 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -14,13 +14,14 @@ description: The following analytic detects the execution of processes with file potentially leading to data exfiltration or further compromise of the network. data_source: - Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 search: '`sysmon` EventCode=1 | stats count min(_time) as firstTime max(_time) as - lastTime, values(Company) as Company values(Product) as Product by dest, user, parent_process_name, - process_name, process | lookup remote_access_software remote_utility_fileinfo AS - Product OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_fileinfo_filter`' + lastTime, values(Company) as Company values(Product) as Product by action dest original_file_name + parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name + parent_process_path process process_exec process_guid process_hash process_id process_integrity_level + process_name process_path user user_id vendor_product | lookup remote_access_software + remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference + as desc, category | search isutility = True | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_fileinfo_filter`' how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities @@ -47,7 +48,7 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate processes on $dest$ +- name: Investigate processes on $dest$ search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -60,7 +61,7 @@ rba: score: 25 - field: user type: user - score: 25 + score: 25 threat_objects: - field: process_name type: process_name @@ -86,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index dfc1a77662..7e5ebc6401 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -19,12 +19,16 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes - where Processes.dest!=unknown Processes.process!=unknown by Processes.dest Processes.user - Processes.process_name Processes.process | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup remote_access_software - remote_utility AS process_name OUTPUT isutility, description as signature, comment_reference - as desc, category | search isutility = True | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_process_filter`' + where Processes.dest!=unknown Processes.process!=unknown by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` + | lookup remote_access_software remote_utility AS process_name OUTPUT isutility, + description as signature, comment_reference as desc, category | search isutility + = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -59,7 +63,7 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate processes on $dest$ +- name: Investigate processes on $dest$ search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -99,7 +103,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index bfaea30e25..24743bc8d6 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,79 +1,82 @@ -name: Detect Remote Access Software Usage Registry -id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 5 -date: '2025-03-24' -author: Steven Dick -status: production -type: Anomaly -description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. -data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.registry_key_name -| `drop_dm_object_name(Registry)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" -| rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" -| eval file_name = coalesce(file_name_1,file_name_2) -| lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category -| search isutility = TRUE -| `remote_access_software_usage_exceptions` -| `detect_remote_access_software_usage_registry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content -references: -- https://attack.mitre.org/techniques/T1219/ -- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ -- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ -drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: Investigate registry changes on $dest$ - search: '| from datamodel:Endpoint.Registry| search dest=$dest$ registry_path=$registry_path$' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: A process for a known remote access software [$signature$] was detected on $dest$ - risk_objects: - - field: dest - type: system - score: 25 - - field: user - type: user - score: 25 - threat_objects: - - field: registry_path - type: registry_path - - field: signature - type: signature -tags: - analytic_story: - - Insider Threat - - Command And Control - - Ransomware - - Gozi Malware - - CISA AA24-241A - - Remote Monitoring and Management Software - - Seashell Blizzard - asset_type: Endpoint - mitre_attack_id: - - T1219 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint - manual_test: This detection uses A&I lookups from Enterprise Security. -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog +name: Detect Remote Access Software Usage Registry +id: 33804986-25dd-43cf-bb6b-dc14956c7cbc +version: 5 +date: '2025-03-24' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" + | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" + | eval file_name = coalesce(file_name_1,file_name_2) + | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category + | search isutility = TRUE + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_registry_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +references: +- https://attack.mitre.org/techniques/T1219/ +- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ +- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate registry changes on $dest$ + search: '| from datamodel:Endpoint.Registry| search dest=$dest$ registry_path=$registry_path$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A process for a known remote access software [$signature$] was detected on $dest$ + risk_objects: + - field: dest + type: system + score: 25 + - field: user + type: user + score: 25 + threat_objects: + - field: registry_path + type: registry_path + - field: signature + type: signature +tags: + analytic_story: + - Insider Threat + - Command And Control + - Ransomware + - Gozi Malware + - CISA AA24-241A + - Remote Monitoring and Management Software + - Seashell Blizzard + asset_type: Endpoint + mitre_attack_id: + - T1219 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + manual_test: This detection uses A&I lookups from Enterprise Security. +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 62309db2ab..8f1dedf31b 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -1,6 +1,6 @@ name: Detect Renamed 7-Zip id: 4057291a-b8cf-11eb-95fe-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=7z*.exe - AND Processes.process_name!=7z*.exe) by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`' + AND Processes.process_name!=7z*.exe) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index a812fd298b..c396f002a5 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,7 +1,7 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: '13' -date: '2025-03-25' +version: 13 +date: '2025-03-27' author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production type: Hunting @@ -19,8 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name!=psexec.exe AND Processes.process_name!=psexec64.exe) AND Processes.original_file_name=psexec.c - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_psexec_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 8d842c1444..d4b903df6d 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -1,7 +1,7 @@ name: Detect Renamed RClone id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: '7' -date: '2025-03-03' +version: 8 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: Hunting @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=rclone.exe - AND Processes.process_name!=rclone.exe) by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`' + AND Processes.process_name!=rclone.exe) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index f676b4c7db..8900ec7c2a 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -1,7 +1,7 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: '10' -date: '2025-02-24' +version: 11 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: Hunting @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe - (Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.original_file_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + (Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index 5e65a0dda2..452101b9f7 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -1,6 +1,6 @@ name: Detect RTLO In File Name id: 468b7e11-d362-43b8-b6ec-7a2d3b246678 -version: 6 +version: 7 date: '2025-02-10' author: Steven Dick status: production @@ -16,9 +16,11 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem - where Filesystem.file_name!=unknown by Filesystem.dest Filesystem.user Filesystem.process_id - Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex + where Filesystem.file_name!=unknown by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex file_name = "\\x{202E}" | rex field=file_name "(?.+)(?\\x{202E})(?.+)" | eval file_name_with_RTLO=file_name | eval file_name=RTLO_file_1.RTLO_file_2 | fields - RTLO* | `detect_rtlo_in_file_name_filter`' @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rtlo_in_process.yml b/detections/endpoint/detect_rtlo_in_process.yml index c9ee16ee83..6357badfa2 100644 --- a/detections/endpoint/detect_rtlo_in_process.yml +++ b/detections/endpoint/detect_rtlo_in_process.yml @@ -1,6 +1,6 @@ name: Detect RTLO In Process id: 22ac27b4-7189-4a4f-9375-b9017c9620d7 -version: 6 +version: 7 date: '2025-02-10' author: Steven Dick status: production @@ -18,9 +18,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process!=unknown AND - Processes.action=allowed by Processes.dest Processes.user Processes.original_file_name - Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.process_guid Processes.parent_process_id | `security_content_ctime(firstTime)` + Processes.action=allowed by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | regex process="\\x{202E}" | rex field=process "(?.+)(?\\x{202E})(?.+)" | eval process_with_RTLO=process | eval process=RTLO_command_1.RTLO_command_2 | @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 710a02181c..b47a9f148c 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - advpack id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*advpack* - by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -86,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 2ee5451c0e..644cd4d8f0 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - setupapi id: 61e7b44a-6088-4f26-b788-9a96ba13b37a -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*setupapi* - by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -86,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 86662d958f..7a7385f65e 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - syssetup id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*syssetup* - by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -86,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 3a1a84e20a..31b46aa937 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Inline HTA Execution id: 91c79f14-5b41-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,9 +20,13 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) - by Processes.user Processes.process_name Processes.parent_process_name Processes.original_file_name - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `detect_rundll32_inline_hta_execution_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `detect_rundll32_inline_hta_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index f1763e793c..e1a4404663 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect SharpHound Command-Line Arguments id: a0bdd2f6-c2ff-11eb-b918-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_sharphound_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 9054f588ce..6f4f8a182b 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -1,6 +1,6 @@ name: Detect SharpHound File Modifications id: 42b4b438-beed-11eb-ba1d-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,8 +18,10 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json", - "*_ous.json", "*_containers.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.dest Filesystem.user| `drop_dm_object_name(Filesystem)` + "*_ous.json", "*_containers.json") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible @@ -77,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index ce759de968..e292dfa6d5 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -1,6 +1,6 @@ name: Detect SharpHound Usage id: dd04b29a-beed-11eb-87bc-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sharphound.exe - OR Processes.original_file_name=SharpHound.exe) by Processes.dest Processes.user - Processes.parent_process_name Processes.original_file_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`' + OR Processes.original_file_name=SharpHound.exe) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_sharphound_usage_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml index 93af7b9881..9788ad2e58 100644 --- a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml +++ b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml @@ -1,6 +1,6 @@ name: Detect suspicious processnames using pretrained model in DSDL id: a15f8977-ad7d-4669-92ef-b59b97219bf5 -version: 5 +version: 6 date: '2024-11-13' author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly @@ -17,12 +17,16 @@ description: The following analytic identifies suspicious process names using a the presence of malware capable of propagating across the network and executing harmful actions. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.parent_process_name - Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` - | rename process_name as text | fields text, parent_process_name, process, user, - dest | apply detect_suspicious_processnames_using_pretrained_model_in_dsdl | rename - predicted_label as is_suspicious_score | rename text as process_name | where is_suspicious_score - > 0.5 | `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`' + as lastTime from datamodel=Endpoint.Processes by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | rename process_name as text | fields text, + parent_process_name, process, user, dest | apply detect_suspicious_processnames_using_pretrained_model_in_dsdl + | rename predicted_label as is_suspicious_score | rename text as process_name | + where is_suspicious_score > 0.5 | `detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 307509b731..53e8f3e6c5 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -1,6 +1,6 @@ name: Detect Use of cmd exe to Launch Script Interpreters id: b89919ed-fe5f-492c-b139-95dbb162039e -version: 9 +version: 10 date: '2025-02-10' author: Bhavin Patel, Mauricio Velazco, Splunk status: production @@ -18,9 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="cmd.exe" - (Processes.process_name=cscript.exe OR Processes.process_name =wscript.exe) by Processes.parent_process - Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`' + (Processes.process_name=cscript.exe OR Processes.process_name =wscript.exe) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 5aff76c6d1..501b884c0d 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -1,6 +1,6 @@ name: Detect WMI Event Subscription Persistence id: 01d9a0c2-cece-11eb-ab46-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic identifies the creation of WMI Event Subscri data_source: - Sysmon EventID 20 search: '`sysmon` EventID=20 | stats count min(_time) as firstTime max(_time) as lastTime - by Computer User Destination | rename Computer as dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `detect_wmi_event_subscription_persistence_filter`' + by dest dvc object object_category object_path signature signature_id src status + user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_wmi_event_subscription_persistence_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID @@ -65,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml index c832f0c8c9..945bb2a461 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -1,6 +1,6 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 6 +version: 7 date: '2024-11-13' author: Bhavin Patel, Splunk status: experimental @@ -19,9 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* - /stext *" OR Processes.process="* /scomma *" ) by Processes.parent_process Processes.process_name - Processes.user Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `detection_of_tools_built_by_nirsoft_filter`' + /stext *" OR Processes.process="* /scomma *" ) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `detection_of_tools_built_by_nirsoft_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 14d1624a73..a43ec8600f 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,6 +1,6 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,11 +18,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows - Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") BY Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.dest Registry.user | `drop_dm_object_name(Registry)` - | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `disable_amsi_through_registry_filter`' + Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index d7b9f60813..23d73ae35d 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 -version: '10' -date: '2025-03-03' +version: 11 +date: '2025-03-27' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -19,10 +19,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") - Registry.registry_value_data = 0x00000001) BY Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.user Registry.dest | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_antivirus_registry_filter`' + Registry.registry_value_data = 0x00000001) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disable_defender_antivirus_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 6ba3bf0b44..1dc7248e71 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,6 +1,6 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,11 @@ description: The following analytic detects the modification of the Windows regi search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data - = 0x00000001) BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.user Registry.dest | - `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_defender_blockatfirstseen_feature_filter`' + = 0x00000001) by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_blockatfirstseen_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 6475fe086a..79ce4fecec 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,6 +1,6 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -15,21 +15,16 @@ description: The following analytic detects the modification of the registry to mechanisms, maintain persistence, and escalate their activities without triggering alerts. data_source: -- Sysmon EventID 1 AND Sysmon EventID 12 -- Sysmon EventID 1 AND Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +- Sysmon EventID 12 +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name - = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001) BY _time - span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_defender_enhanced_notification_filter`' + = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001) by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disable_defender_enhanced_notification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 478158f880..e6230f8ca0 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,6 +1,6 @@ name: Disable Defender MpEngine Registry id: cc391750-3024-11ec-955a-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data - = 0x00000000) BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.user Registry.dest | - `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_defender_mpengine_registry_filter`' + = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_mpengine_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index f14bf9bba4..9c27eb61b6 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,6 +1,6 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data - = 0x00000000) BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.user Registry.dest | - `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`' + = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index a1fb6f378c..466a408f1c 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,6 +1,6 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data - = 0x00000000) BY Registry.user Registry.dest Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_defender_submit_samples_consent_feature_filter`' + = 0x00000000) by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_submit_samples_consent_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index f57b860b1f..4556ffae7f 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -1,6 +1,6 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" - Registry.registry_value_data = "0x00000000") BY Registry.dest Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' + Registry.registry_value_data = "0x00000000") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disable_etw_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 434b6452ec..7cf134f07a 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -1,6 +1,6 @@ name: Disable Logs Using WevtUtil id: 236e7c8e-c9d9-11eb-a824-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,8 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wevtutil.exe" AND (Processes.process = "*sl*" OR Processes.process = "*set-log*" ) Processes.process - = "*/e:false*" by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid + = "*/e:false*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 930c9bc731..c7080c8ebd 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -1,14 +1,13 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP description: The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). It leverages data from the Endpoint.Registry - data model, specifically monitoring changes to the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" + data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" with a value of "0x00000001". This activity is significant because malware, such as RATs or trojans, often disable registry tools to prevent the removal of their entries, aiding in persistence and defense evasion. If confirmed malicious, this @@ -18,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" - Registry.registry_value_data = "0x00000001") BY Registry.user Registry.dest Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| + where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disable_registry_tool_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 43abf6fe4d..2db9f358ce 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -1,6 +1,6 @@ name: Disable Schedule Task id: db596056-3019-11ec-a9ff-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,8 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe - Processes.process=*/change* Processes.process=*/disable* by Processes.user Processes.process_name - Processes.process Processes.parent_process_name Processes.parent_process Processes.dest + Processes.process=*/change* Processes.process=*/disable* by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_schedule_task_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_schtask/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 8dc9c18150..144b97ce74 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -1,6 +1,6 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 9 +version: 10 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,8 +17,9 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") - BY Registry.user Registry.dest Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index fb4e7db623..98d7b67a79 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -1,6 +1,6 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" - Registry.registry_value_data = "0x00000000" )) BY Registry.user Registry.dest Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' + Registry.registry_value_data = "0x00000000" )) by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -68,15 +70,12 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 5b648d3517..9438c3a2c3 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -1,6 +1,6 @@ name: Disable UAC Remote Restriction id: 9928b732-210e-11ec-b65e-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,8 +18,9 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" ) - BY Registry.user Registry.dest Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_uac_remote_restriction_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 338559e409..d168ac71e4 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -1,6 +1,6 @@ name: Disable Windows App Hotkeys id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,11 +17,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= - "HotKey Disabled" AND Registry.registry_value_name = "Debugger") BY Registry.dest - Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `disable_windows_app_hotkeys_filter`' + "HotKey Disabled" AND Registry.registry_value_name = "Debugger") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 2e0c1f7cd4..a8a050e5ff 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,7 +1,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 -version: '12' -date: '2025-03-03' +version: 13 +date: '2025-03-27' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -24,8 +24,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001") - BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index b8c37fc2d2..ad8ca01945 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -1,6 +1,6 @@ name: Disable Windows SmartScreen Protection id: 664f0fd0-91ff-11eb-a56f-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -19,10 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled", "*\\Microsoft\\Windows\\System\\EnableSmartScreen") Registry.registry_value_data IN - ("Off", "0") BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `disable_windows_smartscreen_protection_filter`' + ("Off", "0") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml index 2aeb701771..85b2c87b4c 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml @@ -1,6 +1,6 @@ name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser id: 114c6bfe-9406-11ec-bcce-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the execution of the `Get-ADUser` Po data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename Computer as dest | `security_content_ctime(firstTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -65,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml index b5464753fe..ae431ddbf2 100644 --- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -1,6 +1,6 @@ name: Disabled Kerberos Pre-Authentication Discovery With PowerView id: b0b34e2c-90de-11ec-baeb-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the execution of the `Get-DomainUser data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename Computer as dest | `security_content_ctime(firstTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -62,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 83d068dcf8..6f4dde4f4f 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -1,6 +1,6 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" - Registry.registry_value_data = "0x00000001") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disabling_cmd_application_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index a8e293b0d7..726b04c1ae 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -1,14 +1,13 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP description: The following analytic detects registry modifications that disable the Control Panel on Windows systems. It leverages data from the Endpoint.Registry data - model, specifically monitoring changes to the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" + model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" with a value of "0x00000001". This activity is significant as it is commonly used by malware to prevent users from accessing the Control Panel, thereby hindering the removal of malicious artifacts and persistence mechanisms. If confirmed malicious, @@ -18,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" - Registry.registry_value_data = "0x00000001") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| + where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disabling_controlpanel_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test (XML) attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 6da67d20be..775539d2d2 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -1,6 +1,6 @@ name: Disabling Defender Services id: 911eacdc-317f-11ec-ad30-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -19,10 +19,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data - = 0x00000004) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`' + = 0x00000004) by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index c5d95d266a..1092aa8127 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -1,6 +1,6 @@ name: Disabling Firewall with Netsh id: 6860a62c-9203-11eb-9e05-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= "*disable*") by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`' + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disabling_firewall_with_netsh_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 2223902a7b..829465f384 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -1,6 +1,6 @@ name: Disabling FolderOptions Windows Feature id: 83776de4-921a-11eb-868a-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -8,8 +8,7 @@ type: TTP description: The following analytic detects the modification of the Windows registry to disable the Folder Options feature, which prevents users from showing hidden files and file extensions. It leverages data from the Endpoint.Registry data model, - specifically monitoring changes to the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" + specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" with a value of "0x00000001". This activity is significant as it is commonly used by malware to conceal malicious files and deceive users with fake file extensions. If confirmed malicious, this could allow an attacker to hide their presence and @@ -18,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" - Registry.registry_value_data = "0x00000001") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| + where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disabling_folderoptions_windows_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 11c1abbb8f..15f095558e 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -1,6 +1,6 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -16,10 +16,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" - Registry.registry_value_data = "0x00000001") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| + where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disabling_norun_windows_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 2aebee64f2..c8feea30f1 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -1,6 +1,6 @@ name: Disabling Remote User Account Control id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c -version: 9 +version: 10 date: '2025-02-10' author: David Dorsey, Patrick Bareiss, Splunk status: production @@ -17,9 +17,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* - Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' + Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index a4aeee0833..3f639bbf80 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -1,6 +1,6 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 -version: 10 +version: 11 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -20,11 +20,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows - NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") BY - Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`| - where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `disabling_systemrestore_in_registry_filter`' + NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") by + Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -73,19 +74,15 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 95e16a37af..63a605d2f3 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -1,14 +1,13 @@ name: Disabling Task Manager id: dac279bc-9202-11eb-b7fb-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP description: The following analytic identifies modifications to the Windows registry that disable Task Manager. It leverages data from the Endpoint.Registry data model, - specifically looking for changes to the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" + specifically looking for changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" with a value of "0x00000001". This activity is significant as it is commonly associated with malware such as RATs, Trojans, and worms, which disable Task Manager to prevent users from terminating malicious processes. If confirmed malicious, this could allow @@ -17,10 +16,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" - Registry.registry_value_data = "0x00000001") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `disabling_task_manager_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml index 20ea2dd34b..94791044ff 100644 --- a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml +++ b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml @@ -1,12 +1,12 @@ name: Disabling Windows Local Security Authority Defences via Registry id: 45cd08f8-a2c9-4f4e-baab-e1a0c624b0ab -version: 5 +version: 6 date: '2024-11-13' author: Dean Luxton status: production type: TTP data_source: -- Sysmon EventID 13 AND Sysmon EventID 1 +- Sysmon EventID 13 description: The following analytic identifies the deletion of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. It leverages data from Endpoint Detection and Response (EDR) agents, focusing @@ -18,13 +18,11 @@ description: The following analytic identifies the deletion of registry keys tha search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LsaCfgFlags", "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\*", "*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\RunAsPPL") - Registry.action IN (deleted, unknown) by Registry.action Registry.registry_path - Registry.process_guid Registry.dest Registry.user| `drop_dm_object_name(Registry)` - | join type=outer process_guid [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by Processes.user Processes.process_name Processes.process - Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)`] | table _time action dest user parent_process_name - parent_process process_name process process_guid registry_path | `disabling_windows_local_security_authority_defences_via_registry_filter`' + Registry.action IN (deleted, unknown) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_windows_local_security_authority_defences_via_registry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/disable_lsa_protection/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/disable_lsa_protection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 78d801f784..a101f2e462 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -1,6 +1,6 @@ name: DLLHost with no Command Line Arguments with Network id: f1c07594-a141-11eb-8407-acde48001122 -version: 8 +version: 9 date: '2024-11-13' author: Steven Dick, Michael Haag, Splunk status: experimental @@ -15,16 +15,37 @@ description: The following analytic detects instances of DLLHost.exe running wit network's security. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe - Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" - | rename dest as src | join host process_id [| tstats `security_content_summariesonly` - count latest(All_Traffic.dest) as dest latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) - as dest_port FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port - != 0 by host All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `dllhost_with_no_command_line_arguments_with_network_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=dllhost.exe Processes.action!="blocked" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `dllhost_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,7 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 9e42a31685..71933d3d61 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -1,6 +1,6 @@ name: DNS Exfiltration Using Nslookup App id: 2452e632-9e0d-11eb-bacd-acde48001122 -version: 8 +version: 9 date: '2024-12-10' author: Teoderick Contreras, Splunk, Wouter Jansen status: production @@ -22,8 +22,12 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*" OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="*-type=*" - OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name - Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` + OR Processes.process="*-retry=*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dns_exfiltration_using_nslookup_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -86,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index 73c4f00bf2..391f28c811 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -1,6 +1,6 @@ name: Domain Account Discovery with Dsquery id: b1a8ce04-04c2-11ec-bea7-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe" - AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`' + AND Processes.process = "*user*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 5997c315cc..44d3532984 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -1,6 +1,6 @@ name: Domain Account Discovery with Wmic id: 383572e0-04c5-11ec-bdcc-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -20,8 +20,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process = "*ds_user*" AND Processes.process = "*GET*" AND Processes.process = "*ds_samaccountname*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_account_discovery_with_wmic_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index c2e1e0eb8e..b09399bdd3 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -1,6 +1,6 @@ name: Domain Controller Discovery with Nltest id: 41243735-89a7-4c83-bcdd-570aa78f00a1 -version: 5 +version: 6 date: '2024-12-10' author: Mauricio Velazco, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process="*/dclist:*" - OR Processes.process="*/dsgetdc:*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `domain_controller_discovery_with_nltest_filter`' + OR Processes.process="*/dsgetdc:*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_nltest_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml index da0ebfa675..50c59aefe9 100644 --- a/detections/endpoint/domain_controller_discovery_with_wmic.yml +++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml @@ -1,6 +1,6 @@ name: Domain Controller Discovery with Wmic id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") - (Processes.process="" OR Processes.process="*DomainControllerAddress*") by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_wmic_filter`' + (Processes.process="" OR Processes.process="*DomainControllerAddress*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `domain_controller_discovery_with_wmic_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -49,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 7e402f9632..a38f2cfe18 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -1,6 +1,6 @@ name: Domain Group Discovery with Adsisearcher id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the use of the `[Adsisearcher]` type data_source: - Powershell Script Block Logging 4104 search: '`powershell` (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = - "*(objectcategory=group)*" AND ScriptBlockText = "*findAll()*") | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID - | rename Computer as dest |rename UserID as user | `security_content_ctime(firstTime)` - | `domain_group_discovery_with_adsisearcher_filter`' + "*(objectcategory=group)*" AND ScriptBlockText = "*findAll()*") | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_adsisearcher_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -42,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + message: Domain group discovery enumeration using PowerShell on $dest$ by $user_id$ risk_objects: - field: dest type: system @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 3c80940d89..7589e7be1d 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -1,6 +1,6 @@ name: Domain Group Discovery With Dsquery id: f0c9d62f-a232-4edd-b17e-bc409fb133d4 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") - (Processes.process="*group*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `domain_group_discovery_with_dsquery_filter`' + (Processes.process="*group*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_dsquery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -49,7 +52,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index 0ea13c9e66..73f662b293 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -1,6 +1,6 @@ name: Domain Group Discovery With Wmic id: a87736a6-95cd-4728-8689-3c64d5026b3e -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* AND Processes.process="*GET ds_samaccountname*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `domain_group_discovery_with_wmic_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -49,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 97a948b1af..2339006e50 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,6 +1,6 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects suspicious file downloads by the Tel data_source: - Sysmon EventID 15 search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" - |stats count min(_time) as firstTime max(_time) as lastTime by dest EventCode process_name - process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `download_files_using_telegram_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash + file_name file_path process_exec process_guid process_id process_name process_path + signature signature_id user_id vendor_product Contents Image | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode @@ -65,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/minergate/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 72e21dfb8e..a9b3cd0039 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -1,6 +1,6 @@ name: DSQuery Domain Discovery id: cc316032-924a-11eb-91a2-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe - Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `dsquery_domain_discovery_filter`' + Processes.process=*trustedDomain* by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dsquery_domain_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 7199fc7352..91d6c94fe1 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -1,6 +1,6 @@ name: Dump LSASS via comsvcs DLL id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 -version: 9 +version: 10 date: '2025-02-10' author: Patrick Bareiss, Splunk status: production @@ -20,8 +20,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*comsvcs.dll* - Processes.process IN ("*MiniDump*", "*#24*") by Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.dest + Processes.process IN ("*MiniDump*", "*#24*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -92,7 +96,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index d9e89b8de1..0d153fd895 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -19,8 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma* - OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.original_file_name Processes.dest + OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -85,13 +89,11 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log source: crowdstrike sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 6b8427834e..96877c08f5 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -1,6 +1,6 @@ name: Elevated Group Discovery with PowerView id: 10d62950-0de5-4199-a710-cff9ea79b413 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -18,8 +18,9 @@ data_source: search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroupMember*") AND ScriptBlockText IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -44,11 +45,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index d06e82db3f..19962729f8 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -1,6 +1,6 @@ name: Elevated Group Discovery With Wmic id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -23,9 +23,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns - Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`' + Admins*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `elevated_group_discovery_with_wmic_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 4ccbfbd7e0..5193979e87 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -1,6 +1,6 @@ name: Enable RDP In Other Port Number id: 99495452-b899-11eb-96dc-acde48001122 -version: 10 +version: 11 date: '2024-12-16' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,11 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Control\\Terminal - Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") BY Registry.dest - Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `enable_rdp_in_other_port_number_filter`' + Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 4fae14ea04..cf32813a6f 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -1,6 +1,6 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 9 +version: 10 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,8 +18,9 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) - BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index b4f247be75..04f6e17fa0 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -1,6 +1,6 @@ name: Esentutl SAM Copy id: d372f928-ce4f-11eb-a762-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_esentutl` Processes.process - IN ("*ntds*", "*SAM*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `esentutl_sam_copy_filter`' + IN ("*ntds*", "*SAM*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esentutl_sam_copy_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index c2be3b0a81..673c79c9fc 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -1,6 +1,6 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 11 +version: 12 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,8 +18,9 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000) - BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -74,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 87c438a3b5..434a84f21d 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -1,6 +1,6 @@ name: Eventvwr UAC Bypass id: 9cf8fe08-7ad8-11eb-9819-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Steven Dick, Michael Haag, Splunk status: production @@ -14,20 +14,14 @@ description: The following analytic detects an Eventvwr UAC bypass by identifyin malicious, this could lead to unauthorized code execution, persistence, and further compromise of the affected system. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path="*mscfile\\shell\\open\\command\\*") BY _time span=1h - Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `eventvwr_uac_bypass_filter`' +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + WHERE (Registry.registry_path="*mscfile\\shell\\open\\command\\*") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `eventvwr_uac_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -86,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 613e48bf8e..6249499960 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -1,6 +1,6 @@ name: Excessive Attempt To Disable Services id: 8fa2a0f0-acd9-11eb-8994-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,12 +17,20 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = - "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name - Processes.parent_process_name Processes.dest Processes.user _time span=1m | where - count >=4 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` +search: '| tstats `security_content_summariesonly` values(Processes.action) as action + values(Processes.original_file_name) as original_file_name values(Processes.parent_process) + as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) + as parent_process_guid values(Processes.parent_process_id) as parent_process_id + values(Processes.parent_process_path) as parent_process_path values(Processes.process) + as process values(Processes.process_exec) as process_exec values(Processes.process_guid) + as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) + as process_id values(Processes.process_integrity_level) as process_integrity_level + values(Processes.process_path) as process_path values(Processes.user_id) as user_id + values(Processes.vendor_product) as vendor_product count min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name + = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by + Processes.process_name Processes.parent_process_name Processes.dest Processes.user + _time span=1m | where count >=4 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -75,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml index 49dfca5f3e..79c7f38ad4 100644 --- a/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml +++ b/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml @@ -1,6 +1,6 @@ name: Excessive distinct processes from Windows Temp id: 23587b6a-c479-11eb-b671-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Hart, Mauricio Velazco, Splunk status: production @@ -17,10 +17,19 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path - = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where +search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) + as distinct_process_count min(_time) as firstTime max(_time) as lastTime values(Processes.action) + as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process) + as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) + as parent_process_guid values(Processes.parent_process_id) as parent_process_id + values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) + as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) + as vendor_product from datamodel=Endpoint.Processes where Processes.process_path + = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -72,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index cc43bf87e4..0892330e2e 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -1,6 +1,6 @@ name: Excessive File Deletion In WinDefender Folder id: b5baa09a-7a05-11ec-8da4-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -15,9 +15,12 @@ data_source: - Sysmon EventID 23 - Sysmon EventID 26 search: '`sysmon` EventCode IN ("23","26") TargetFilename = "*\\ProgramData\\Microsoft\\Windows - Defender\\*" | stats count, values(TargetFilename) as deleted_files, min(_time) - as firstTime, max(_time) as lastTime by user, dest, signature, signature_id, Image, - process_name, process_guid | rename Image as process | where count >=50 | `security_content_ctime(firstTime)` + Defender\\*" | stats count min(_time) as firstTime, max(_time) as lastTime values(file_path) + as file_path values(file_hash) as file_hash values(file_name) as file_name values(file_modify_time) + as file_modify_time values(process_name) as process_name values(process_path) as + process_path values(process_guid) as process_guid values(process_id) as process_id + values(process_exec) as process_exec by action dest dvc signature signature_id user + user_id vendor_product | where count >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_file_deletion_in_windefender_folder_filter`' how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. @@ -52,7 +55,7 @@ rba: type: system score: 25 threat_objects: - - field: deleted_files + - field: file_name type: file_name tags: analytic_story: @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 8e55318d13..3ca23aaa06 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -1,6 +1,6 @@ name: Excessive number of service control start as disabled id: 77592bec-d5cc-11eb-9e60-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Hart, Splunk status: production @@ -18,7 +18,15 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) - as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime + as distinct_cmdlines values(Processes.action) as action values(Processes.original_file_name) + as original_file_name values(Processes.parent_process_exec) as parent_process_exec + values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) + as parent_process_name values(Processes.parent_process_path) as parent_process_path + values(Processes.process) as process values(Processes.process_exec) as process_exec + values(Processes.process_guid) as process_guid values(Processes.process_hash) as + process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) + as user_id values(Processes.vendor_product) as vendor_product min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, _time @@ -78,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index d31f36a50d..848b988bf1 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -1,6 +1,6 @@ name: Excessive number of taskhost processes id: f443dac2-c7cf-11eb-ab51-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Hart status: production @@ -17,16 +17,32 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process_id) as - process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes +search: '| tstats `security_content_summariesonly` values(Processes.action) as action + values(Processes.original_file_name) as original_file_name values(Processes.parent_process) + as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) + as parent_process_guid values(Processes.parent_process_id) as parent_process_id + values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.user) as user values(Processes.process_path) + as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) + as vendor_product min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe" BY Processes.dest Processes.process_name _time span=1h | `drop_dm_object_name(Processes)` - | eval pid_count=mvcount(process_ids) | eval taskhost_count_=if(process_name == - "taskhost.exe", pid_count, 0) | eval taskhostex_count_=if(process_name == "taskhostex.exe", - pid_count, 0) | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) - as taskhostex_count by _time, dest, firstTime, lastTime | where taskhost_count > - 10 or taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `excessive_number_of_taskhost_processes_filter`' + | eval pid_count=mvcount(process_id) | eval taskhost_count_=if(process_name == "taskhost.exe", + pid_count, 0) | eval taskhostex_count_=if(process_name == "taskhostex.exe", pid_count, + 0) | stats sum(taskhost_count_) as taskhost_count, sum(taskhostex_count_) as taskhostex_count + values(action) as action values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_guid) as process_guid + values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) + as process_integrity_level values(user) as user values(process_path) as process_path + values(user_id) as user_id values(vendor_product) as vendor_product values(process_name) + as process_name by _time, dest, firstTime, lastTime | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index f6a5a7eec9..25116f8ff8 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -1,6 +1,6 @@ name: Excessive Usage Of Cacls App id: 0bdf6092-af17-11eb-939a-acde48001122 -version: 6 +version: 7 date: '2024-12-16' author: Teoderick Contreras, Splunk status: production @@ -16,12 +16,20 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id values(Processes.process_name) as process_name - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" - OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process - Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` +search: '| tstats `security_content_summariesonly` values(Processes.dest) as dest + values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime values(Processes.action) + as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) + as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) + as vendor_product count from datamodel=Endpoint.Processes where Processes.process_name + = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name + = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process Processes.dest + Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -79,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 4c46de9669..a85d26aefa 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,6 +1,6 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Stanislav Miskovic, Splunk status: production @@ -17,11 +17,23 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=1m - | stats count as numNsLookup by dest, _time | eventstats avg(numNsLookup) as avgNsLookup, - stdev(numNsLookup) as stdNsLookup, count as numSlots by dest | eval upperThreshold=(avgNsLookup - + stdNsLookup *3) | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, - 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count as numNsLookup min(_time) + as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) + as original_file_name values(Processes.parent_process_exec) as parent_process_exec + values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) + as parent_process_name values(Processes.parent_process_path) as parent_process_path + values(Processes.process) as process values(Processes.process_exec) as process_exec + values(Processes.process_guid) as process_guid values(Processes.process_hash) as + process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) + as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) + as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) + as parent_process_id values(Processes.user) as user from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" by Processes.dest _time span=1m | + `drop_dm_object_name(Processes)` | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) + as stdNsLookup, count as numSlots by dest | eval upperThreshold=(avgNsLookup + stdNsLookup + *3) | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) + | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -71,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index a7cbd28e9d..3288432f72 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -1,6 +1,6 @@ name: Excessive Usage Of SC Service Utility id: cb6b339e-d4c6-11eb-a026-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,13 +15,22 @@ description: The following analytic detects excessive usage of the `sc.exe` serv leading to system compromise or disruption of security defenses. data_source: - Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | - stats values(process) as process count as numScExe by dest, _time | eventstats - avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by dest - | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe > - 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` +search: '| tstats `security_content_summariesonly` count as numScExe min(_time) as + firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) + as original_file_name values(Processes.parent_process_exec) as parent_process_exec + values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) + as parent_process_name values(Processes.parent_process_path) as parent_process_path + values(Processes.process) as process values(Processes.process_exec) as process_exec + values(Processes.process_guid) as process_guid values(Processes.process_hash) as + process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) + as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) + as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) + as parent_process_id values(Processes.user) as user from datamodel=Endpoint.Processes + where Processes.process_name = "sc.exe" by Processes.dest _time span=15m | `drop_dm_object_name(Processes)` + | eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots + by dest | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe + > 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -68,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 58c6c1d2c6..7a274aa567 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -1,6 +1,6 @@ name: Excessive Usage Of Taskkill id: fe5bca48-accb-11eb-a67c-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,12 +17,20 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by - Processes.parent_process_name Processes.process_name Processes.dest Processes.user - _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.action) as action values(Processes.dest) as dest values(Processes.original_file_name) + as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) + as user values(Processes.user_id) as user_id values(Processes.vendor_product) as + vendor_product from datamodel=Endpoint.Processes where Processes.process_name = + "taskkill.exe" by Processes.parent_process_name Processes.process_name Processes.dest + Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/exchange_powershell_module_usage.yml b/detections/endpoint/exchange_powershell_module_usage.yml index a4a976b447..a002070aec 100644 --- a/detections/endpoint/exchange_powershell_module_usage.yml +++ b/detections/endpoint/exchange_powershell_module_usage.yml @@ -1,6 +1,6 @@ name: Exchange PowerShell Module Usage id: 2d10095e-05ae-11ec-8fdf-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,9 +18,10 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*", "Search-Mailbox") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename Computer as dest |rename UserID as user - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `exchange_powershell_module_usage_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -75,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 6ca58b898b..d559a0ad9b 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -18,8 +18,8 @@ data_source: search: '`wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.exe","*.dll") ObjectType=File ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") AccessMask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode - ShareName RelativeTargetName ObjectType AccessMask src_user src_port IpAddress | - `security_content_ctime(firstTime)` | `executable_file_written_in_administrative_smb_share_filter`' + ShareName RelativeTargetName ObjectType AccessMask src_user src_port IpAddress dest + | `security_content_ctime(firstTime)` | `executable_file_written_in_administrative_smb_share_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. @@ -78,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 0fde8612a1..2250bca972 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: '12' -date: '2025-02-28' +version: 13 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,15 +15,18 @@ description: The following analytic identifies the creation of executables or sc a significant security threat. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") - AND Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", - "*\\Windows\\repair\\*", "*\\PerfLogs\\*") AND NOT(Filesystem.file_path IN("*\\temp\\*")) - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `executables_or_script_creation_in_suspicious_path_filter`' +search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", + "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", + "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", + "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*") + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 048578c69d..22f4901a81 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 11 -date: '2025-02-11' +version: 12 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,14 +15,15 @@ description: The following analytic identifies the creation of executables or sc a significant security threat. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") - AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", "*:\\Windows\\Temp\\*", "*:\\Temp*") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `executables_or_script_creation_in_temp_path_filter`' +search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", + "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\AppData\\Local\\Temp\\*", + "*:\\Windows\\Temp\\*", "*:\\Temp*") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_temp_path_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -48,8 +49,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Potentially suspicious executable or script with file name $file_name$, $file_path$ - and process_id $process_id$ was created in temporary folder by $user$ + message: Potentially suspicious executable or script with file name $file_name$, + $file_path$ and process_id $process_id$ was created in temporary folder by $user$ risk_objects: - field: user type: user diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 7099216131..7600020d9f 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -1,6 +1,6 @@ name: Execute Javascript With Jscript COM CLSID id: dc64d064-d346-11eb-8588-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe" - Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name - Processes.process_name Processes.process Processes.parent_process Processes.process_id - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`' + Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `execute_javascript_with_jscript_com_clsid_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index c7c46d2a00..a22538c36e 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -1,6 +1,6 @@ name: Execution of File with Multiple Extensions id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 -version: 9 +version: 10 date: '2025-02-10' author: Rico Valdez, Teoderick Contreras, Splunk status: production @@ -20,8 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", "*.docx.exe", - "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") by Processes.dest - Processes.user Processes.process Processes.process_name Processes.parent_process + "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index f09d658da1..86ed3f6ce0 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -1,6 +1,6 @@ name: File with Samsam Extension id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf -version: 6 +version: 7 date: '2024-11-13' author: Rico Valdez, Splunk status: production @@ -14,14 +14,15 @@ description: The following analytic detects file writes with extensions indicati should include isolating affected systems, restoring files from backups, and investigating the attack source to prevent further incidents. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) - as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex - field=file_name "(?\.[^\.]+)$" | search file_extension=.stubbin + as file_path from datamodel=Endpoint.Filesystem by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| + rex field=file_name "(?\.[^\.]+)$" | search file_extension=.stubbin OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos OR file_extension=.keyxml | `file_with_samsam_extension_filter`' how_to_implement: You must be ingesting data that records file-system activity from @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/samsam_extension/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/samsam_extension/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index 11f599d75e..c099e68c1c 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -1,6 +1,6 @@ name: Firewall Allowed Program Enable id: 9a8f63a8-43ac-11ec-904c-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `firewall_allowed_program_enable_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index dd00bbb7e0..e81f4d8758 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -1,6 +1,6 @@ name: First Time Seen Child Process of Zoom id: e91bd102-d630-4e76-ab73-7e3ba22c5961 -version: 5 +version: 6 date: '2024-11-13' author: David Dorsey, Splunk status: experimental @@ -16,16 +16,23 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` min(_time) as firstTime values(Processes.parent_process_name) - as parent_process_name values(Processes.parent_process_id) as parent_process_id - values(Processes.process_name) as process_name values(Processes.process) as process - from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe - OR Processes.parent_process_name=zoom.us) by Processes.process_id Processes.dest - | `drop_dm_object_name(Processes)` | lookup zoom_first_time_child_process dest as - dest process_name as process_name OUTPUT firstTimeSeen | where isnull(firstTimeSeen) - OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") - | `security_content_ctime(firstTime)` | table firstTime dest, process_id, process_name, - parent_process_id, parent_process_name |`first_time_seen_child_process_of_zoom_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime values(Processes.user) as user values(Processes.action) as action values(Processes.dest) + as dest values(Processes.original_file_name) as original_file_name values(Processes.parent_process) + as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) + as parent_process_guid values(Processes.parent_process_id) as parent_process_id + values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_integrity_level) as process_integrity_level + values(Processes.process_name) as process_name values(Processes.process_path) as + process_path values(Processes.user) as user values(Processes.user_id) as user_id + values(Processes.vendor_product) as vendor_product from datamodel=Endpoint.Processes + where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) + by Processes.process_id Processes.dest | `drop_dm_object_name(Processes)` | lookup + zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen + | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") + | `security_content_ctime(firstTime)` | `first_time_seen_child_process_of_zoom_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 643bf866c4..f0a7eebd5b 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -1,6 +1,6 @@ name: FodHelper UAC Bypass id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -83,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 91e21bf58e..6a7c144866 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -1,6 +1,6 @@ name: Fsutil Zeroing File id: 4e5e024e-fabb-11eb-8b8f-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe - Processes.process="*setzerodata*" by Processes.user Processes.process_name Processes.parent_process_name - Processes.dest Processes.process Processes.parent_process | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fsutil_zeroing_file_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `fsutil_zeroing_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index 70746a5993..8e782db553 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -1,6 +1,6 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell id: 36e46ebe-065a-11ec-b4c7-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -52,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index a77b953e01..7554c50b34 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block id: 1ff7ccc8-065a-11ec-91e4-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -16,9 +16,10 @@ description: The following analytic detects the execution of the `Get-ADDefaultD data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -41,7 +42,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index 19c5c4c847..e72d6560ed 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -1,6 +1,6 @@ name: Get ADUser with PowerShell id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" - AND Processes.process = "*-filter*" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`' + AND Processes.process = "*-filter*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -53,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index 4ea837065c..3f42a1d3e1 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -16,9 +16,10 @@ description: The following analytic detects the execution of the `Get-AdUser` Po data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText - = "*-filter*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - ScriptBlockText Computer UserID | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`' + = "*-filter*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime + by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path + ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -42,7 +43,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index e5a8d6839d..395e465b2b 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -1,6 +1,6 @@ name: Get ADUserResultantPasswordPolicy with Powershell id: 8b5ef342-065a-11ec-b0fc-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index 5370f63e74..342c422844 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Get ADUserResultantPasswordPolicy with Powershell Script Block id: 737e1eb0-065a-11ec-921a-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -16,9 +16,10 @@ description: The following analytic detects the execution of the `Get-ADUserResu data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename Computer as dest | rename UserID as user - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -28,13 +29,13 @@ references: - https://attack.mitre.org/techniques/T1201/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -48,7 +49,7 @@ rba: - field: dest type: system score: 9 - - field: user + - field: user_id type: user score: 9 threat_objects: [] @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 01f20fddfa..ce88dad3e4 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -1,6 +1,6 @@ name: Get DomainPolicy with Powershell id: b8f9947e-065a-11ec-aafb-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index b48ac3b943..1a7a100dec 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Get DomainPolicy with Powershell Script Block id: a360d2b2-065a-11ec-b0bf-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the `Get-DomainPoli or lateral movement within the network. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | stats - count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | rename UserID as user | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -44,10 +44,10 @@ drilldown_searches: rba: message: Powershell process with command line indicative of querying domain policy. risk_objects: - - field: Computer + - field: dest type: system score: 30 - - field: user + - field: user_id type: user score: 30 threat_objects: [] @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index b694145437..67d8026806 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -1,6 +1,6 @@ name: Get-DomainTrust with PowerShell id: 4fa7f846-054a-11ec-a836-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -20,9 +20,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*get-domaintrust* - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_domaintrust_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml index 49b74c7d07..15a5a585f3 100644 --- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Get-DomainTrust with PowerShell Script Block id: 89275e7e-0548-11ec-bf75-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the Get-DomainTrust and compromise of additional systems. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" | stats - count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -31,12 +31,12 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -46,9 +46,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ - by user $user$. + by user $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 12 - field: dest @@ -69,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index b7844e4976..ecbb4a7059 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -1,6 +1,6 @@ name: Get DomainUser with PowerShell id: 9a5a41d6-04e7-11ec-923c-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -21,8 +21,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 9fb765be7e..f6fe73f535 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Get DomainUser with PowerShell Script Block id: 61994268-04f4-11ec-865c-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the `Get-DomainUser and potential exploitation of domain resources. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -46,7 +46,7 @@ rba: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 06ed2a33db..c2696029f1 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -1,6 +1,6 @@ name: Get-ForestTrust with PowerShell id: 584f4884-0bf1-11ec-a5ec-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe - OR Processes.process_name=cmd.exe Processes.process=*get-foresttrust* by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_filter`' + OR Processes.process_name=cmd.exe Processes.process=*get-foresttrust* by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_foresttrust_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml index 8f5863abd2..77c5dbf96a 100644 --- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Get-ForestTrust with PowerShell Script Block id: 70fac80e-0bf1-11ec-9ba0-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the Get-ForestTrust further exploitation and access to sensitive resources. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -27,12 +27,12 @@ references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -42,9 +42,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ - by user $user$. + by user $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 12 - field: dest @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index eb0c67807c..6ecfdcf444 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -1,6 +1,6 @@ name: Get WMIObject Group Discovery id: 5434f670-155d-11ec-8cca-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe OR processes.process_name=cmd.exe) (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index b6b6ec3604..c783e60eb6 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -1,6 +1,6 @@ name: Get WMIObject Group Discovery with Script Block Logging id: 69df7f7c-155d-11ec-a055-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the execution of the `Get-WMIObject data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText - = "*Win32_Group*" | stats count min(_time) as firstTime max(_time) as lastTime by - EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_with_script_block_logging_filter`' + = "*Win32_Group*" | fillnull | stats count min(_time) as firstTime max(_time) as + lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_wmiobject_group_discovery_with_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -43,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml index 57df18394d..14209d6158 100644 --- a/detections/endpoint/getadcomputer_with_powershell.yml +++ b/detections/endpoint/getadcomputer_with_powershell.yml @@ -1,6 +1,6 @@ name: GetAdComputer with PowerShell id: c5a31f80-5888-4d81-9f78-1cc65026316e -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-AdComputer*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getadcomputer_with_powershell_filter`' + (Processes.process=*Get-AdComputer*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadcomputer_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -49,7 +52,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index c0723130b0..5359ebaa4d 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetAdComputer with PowerShell Script Block id: a9a1da02-8e27-4bf7-a348-f4389c9da487 -version: 6 +version: 7 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the execution of the `Get-AdComputer access and data exfiltration. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | stats - count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -42,7 +43,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 8f87c04925..c41ce37690 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -1,6 +1,6 @@ name: GetAdGroup with PowerShell id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-AdGroup*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getadgroup_with_powershell_filter`' + (Processes.process=*Get-AdGroup*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 5f765ba70b..6e7cd38a27 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetAdGroup with PowerShell Script Block id: e4c73d68-794b-468d-b4d0-dac1772bbae7 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -14,10 +14,10 @@ description: The following analytic detects the execution of the `Get-AdGroup` P by providing attackers with detailed information about the domain's group structure. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*" | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer - UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -40,7 +40,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index 0b6c3fdefc..11fd09b11f 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -1,6 +1,6 @@ name: GetCurrent User with PowerShell id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getcurrent_user_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -49,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index 2203c5173f..70b9412124 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetCurrent User with PowerShell Script Block id: 80879283-c30f-44f7-8471-d1381f6d437a -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the execution of the `GetCurrent` me data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*" ScriptBlockText - = "*GetCurrent()*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getcurrent_user_with_powershell_script_block_filter`' + = "*GetCurrent()*" | fillnull | stats count min(_time) as firstTime max(_time) as + lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -42,7 +42,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml index 4cada0e98a..cf79d7fda4 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell.yml @@ -1,6 +1,6 @@ name: GetDomainComputer with PowerShell id: ed550c19-712e-43f6-bd19-6f58f61b3a5e -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-DomainComputer*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getdomaincomputer_with_powershell_filter`' + (Processes.process=*Get-DomainComputer*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincomputer_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml index 6110518366..eeb7ce7699 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetDomainComputer with PowerShell Script Block id: f64da023-b988-4775-8d57-38e512beb56e -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the execution of the `Get-DomainComp data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*") | - stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID - EventCode ScriptBlockText | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` + fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature + signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId + ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincomputer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -41,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Remote system discovery with PowerView on $dest$ by $user$ + message: Remote system discovery with PowerView on $dest$ by $user_id$ risk_objects: - field: dest type: system @@ -61,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index bfeaa95e16..863805b98b 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -1,6 +1,6 @@ name: GetDomainController with PowerShell id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-DomainController*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getdomaincontroller_with_powershell_filter`' + (Processes.process=*Get-DomainController*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaincontroller_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml index 7d2d8523fc..a6654161ab 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetDomainController with PowerShell Script Block id: 676b600a-a94d-4951-b346-11329431e6c1 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the execution of the `Get-DomainCont data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -41,9 +42,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Remote system discovery with PowerView on $Computer$ by $UserID$ + message: Remote system discovery with PowerView on $dest$ by $user_id$ risk_objects: - - field: Computer + - field: dest type: system score: 24 threat_objects: [] @@ -61,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 8c01054c4b..bb5d457fad 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -1,6 +1,6 @@ name: GetDomainGroup with PowerShell id: 93c94be3-bead-4a60-860f-77ca3fe59903 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,10 +20,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-DomainGroup*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getdomaingroup_with_powershell_filter`' + (Processes.process=*Get-DomainGroup*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index bad857a4c9..8555a29caf 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetDomainGroup with PowerShell Script Block id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the execution of the `Get-DomainGrou privilege escalation and lateral movement within the network. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") | stats - count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -41,9 +42,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Domain group discovery enumeration using PowerView on $Computer$ by $UserID$ + message: Domain group discovery enumeration using PowerView on $dest$ by $user_id$ risk_objects: - - field: Computer + - field: dest type: system score: 15 threat_objects: [] @@ -61,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 7819e2520b..2fcb245e2f 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -1,6 +1,6 @@ name: GetLocalUser with PowerShell id: 85fae8fa-0427-11ec-8b78-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-LocalUser*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getlocaluser_with_powershell_filter`' + (Processes.process=*Get-LocalUser*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml index 5e8423446f..be98ab7e9c 100644 --- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml +++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetLocalUser with PowerShell Script Block id: 2e891cbe-0426-11ec-9c9c-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the `Get-LocalUser` for privilege escalation or lateral movement. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-LocalUser*") | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getlocaluser_with_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-LocalUser*") | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -43,7 +43,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml index bedb098129..d0afa95f9e 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell.yml @@ -1,6 +1,6 @@ name: GetNetTcpconnection with PowerShell id: e02af35c-1de5-4afe-b4be-f45aba57272b -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-NetTcpConnection*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getnettcpconnection_with_powershell_filter`' + (Processes.process=*Get-NetTcpConnection*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getnettcpconnection_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml index aa0100c6f2..595b2e0906 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetNetTcpconnection with PowerShell Script Block id: 091712ff-b02a-4d43-82ed-34765515d95d -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -16,8 +16,10 @@ description: The following analytic detects the execution of the `Get-NetTcpconn data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getnettcpconnection_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -40,7 +42,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 207b36cf90..c7fbc954a2 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -1,6 +1,6 @@ name: GetWmiObject Ds Computer with PowerShell id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -21,8 +21,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" - AND Processes.process="*class ds_computer*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + AND Processes.process="*class ds_computer*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml index ab5ae3dd63..8f0b49aab1 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetWmiObject Ds Computer with PowerShell Script Block id: 29b99201-723c-4118-847a-db2b3d3fb8ea -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the execution of the `Get-WmiObject` data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace - root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | stats count - min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`' + root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | fillnull | + stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -41,9 +42,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Remote system discovery enumeration on $Computer$ by $UserID$ + message: Remote system discovery enumeration on $dest$ by $user_id$ risk_objects: - - field: Computer + - field: dest type: system score: 15 threat_objects: [] @@ -61,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index f0dc6262b2..ab6d4ddb71 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -1,6 +1,6 @@ name: GetWmiObject Ds Group with PowerShell id: df275a44-4527-443b-b884-7600e066e3eb -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" - AND Processes.process="*class ds_group*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `getwmiobject_ds_group_with_powershell_filter`' + AND Processes.process="*class ds_group*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index 36a64083ac..ab4b128b5f 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetWmiObject Ds Group with PowerShell Script Block id: 67740bd3-1506-469c-b91d-effc322cc6e5 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the `Get-WmiObject` data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace - root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | stats count min(_time) - as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText - | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`|`getwmiobject_ds_group_with_powershell_script_block_filter`' + root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`getwmiobject_ds_group_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -42,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + message: Domain group discovery enumeration using PowerShell on $dest$ by $user_id$ risk_objects: - field: dest type: system @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index eeb6e39b17..650b9860ed 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -1,6 +1,6 @@ name: GetWmiObject DS User with PowerShell id: 22d3b118-04df-11ec-8fa3-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" AND Processes.process = "*ds_user*" AND Processes.process = "*root\\directory\\ldap*" - AND Processes.process = "*-namespace*" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`' + AND Processes.process = "*-namespace*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index ab9fdb89c4..6a09c983fa 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetWmiObject DS User with PowerShell Script Block id: fabd364e-04f3-11ec-b34b-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -17,9 +17,10 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*" ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename Computer as dest | rename UserID as user| - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getwmiobject_ds_user_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -28,13 +29,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -48,7 +49,7 @@ rba: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index 8733ba54ea..43b5652cfd 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -1,6 +1,6 @@ name: GetWmiObject User Account with PowerShell id: b44f6ac6-0429-11ec-87e9-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*) by - Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`' + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getwmiobject_user_account_with_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml index 8677fb28ab..2076c9797a 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml @@ -1,6 +1,6 @@ name: GetWmiObject User Account with PowerShell Script Block id: 640b0eda-0429-11ec-accd-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -15,8 +15,10 @@ description: The following analytic detects the execution of the `Get-WmiObject` data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getwmiobject_user_account_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -42,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index 46ab4b2a2e..44b2166007 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,6 +1,6 @@ name: GPUpdate with no Command Line Arguments with Network id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -16,16 +16,37 @@ description: The following analytic detects the execution of gpupdate.exe withou leading to system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id - Processes.process_name Processes.dest Processes.user Processes.process_path Processes.process - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"| - join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port - | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest - parent_process_name process_name process_path process process_id dest_port C2 | - `gpupdate_with_no_command_line_arguments_with_network_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=gpupdate.exe by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where + All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `gpupdate_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -55,9 +76,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Process gpupdate.exe with parent_process $parent_process_name$ is executed - on $dest$ by user $user$, followed by an outbound network connection to $C2$ on - port $dest_port$. This behaviour is seen with cobaltstrike. + message: Process gpupdate.exe with parent_process $parent_process_name$ is executed + on $dest$ by user $user$, followed by an outbound network connection on port $dest_port$. + This behaviour is seen with cobaltstrike. risk_objects: - field: user type: user @@ -68,8 +89,6 @@ rba: threat_objects: - field: parent_process_name type: parent_process_name - - field: C2 - type: ip_address tags: analytic_story: - Graceful Wipe Out Attack @@ -87,7 +106,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml index 6d6557e0ab..07cf845c87 100644 --- a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml +++ b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml @@ -1,6 +1,6 @@ name: Headless Browser Mockbin or Mocky Request id: 94fc85a1-e55b-4265-95e1-4b66730e05c0 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ description: The following analytic detects headless browser activity accessing search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*--headless*" AND Processes.process="*--disable-gpu*" AND (Processes.process="*mockbin.org/*" - OR Processes.process="*mocky.io/*")) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `headless_browser_mockbin_or_mocky_request_filter`' + OR Processes.process="*mocky.io/*")) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `headless_browser_mockbin_or_mocky_request_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/headless_browser_usage.yml b/detections/endpoint/headless_browser_usage.yml index a9351e7245..5c0ad360e7 100644 --- a/detections/endpoint/headless_browser_usage.yml +++ b/detections/endpoint/headless_browser_usage.yml @@ -1,6 +1,6 @@ name: Headless Browser Usage id: 869ba261-c272-47d7-affe-5c0aa85c93d6 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -20,10 +20,13 @@ description: The following analytic detects the usage of headless browsers withi applications. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*--headless*" - AND Processes.process="*--disable-gpu*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `headless_browser_usage_filter`' + AND Processes.process="*--disable-gpu*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `headless_browser_usage_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -48,7 +51,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 9e4a6ec18a..34a600d43a 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -1,6 +1,6 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data - = "0x00000000") BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`' + = "0x00000000") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -74,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 9e314746a6..45c5b4aa75 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -1,6 +1,6 @@ name: Hiding Files And Directories With Attrib exe id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 -version: 10 +version: 11 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe - (Processes.process=*+h*) by Processes.parent_process_name Processes.process_name - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` - |`hiding_files_and_directories_with_attrib_exe_filter`' + (Processes.process=*+h*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` |`hiding_files_and_directories_with_attrib_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 2214668507..d909b5ac0d 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -1,6 +1,6 @@ name: High Process Termination Frequency id: 17cd75b2-8666-11eb-9ab4-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras status: production @@ -14,9 +14,12 @@ description: The following analytic identifies a high frequency of process termi file encryption and significant data loss. data_source: - Sysmon EventID 5 -search: '`sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated - min(_time) as firstTime max(_time) as lastTime count by _time dest EventCode ProcessID - | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`sysmon` EventCode=5 | bin _time span=3s | stats values(process) as process + values(process_exec) as process_exec values(process_guid) as process_guid values(process_id) + as process_id values(process_name) as process_name values(process_path) as process_path + values(user_id) as user_id min(_time) as firstTime max(_time) as lastTime count + by _time dest EventCode ProcessID signature signature_id vendor_product | where + count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `high_process_termination_frequency_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. @@ -46,9 +49,7 @@ rba: - field: dest type: system score: 72 - threat_objects: - - field: proc_terminated - type: process + threat_objects: [] tags: analytic_story: - LockBit Ransomware @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/hunting_3cxdesktopapp_software.yml b/detections/endpoint/hunting_3cxdesktopapp_software.yml index 67d921a0ac..be7994e41e 100644 --- a/detections/endpoint/hunting_3cxdesktopapp_software.yml +++ b/detections/endpoint/hunting_3cxdesktopapp_software.yml @@ -1,6 +1,6 @@ name: Hunting 3CXDesktopApp Software id: 553d0429-1a1c-44bf-b3f5-a8513deb9ee5 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: Hunting @@ -18,10 +18,13 @@ description: The following analytic detects the presence of any version of the 3 access, data exfiltration, or further compromise of the affected systems. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=3CXDesktopApp.exe - OR Processes.process_name="3CX Desktop App" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `hunting_3cxdesktopapp_software_filter`' + OR Processes.process_name="3CX Desktop App" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hunting_3cxdesktopapp_software_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -56,7 +59,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 20178963ee..986480a347 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,6 +1,6 @@ name: Icacls Deny Command id: cf8d753e-a8fe-11eb-8f58-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", - "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/deny*", "*/D*") by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`' + "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/deny*", "*/D*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `icacls_deny_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index a3850db7a3..30ece33739 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -1,6 +1,6 @@ name: ICACLS Grant Command id: b1b1e316-accc-11eb-a9b4-acde48001122 -version: '5' +version: 6 date: '2024-12-17' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", - "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`' + "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `icacls_grant_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 2a4a093612..c1ed65867b 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -1,6 +1,6 @@ name: IcedID Exfiltrated Archived File Creation id: 0db4da70-f14b-11eb-8043-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -14,13 +14,15 @@ description: The following analytic detects the creation of suspicious files nam allow attackers to access personal information, conduct further phishing attacks, or escalate their presence within the network. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '`sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename - = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by - TargetFilename EventCode process_id process_name dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count values(Filesystem.file_path) + as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_path="*\\passff.tar" OR Filesystem.file_path="*\\cookie.tar" + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -42,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 7325419b34..7244cf8fe4 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -1,6 +1,6 @@ name: Impacket Lateral Movement Commandline Parameters id: 8ce07472-496f-11ec-ab3b-3e22fbd008af -version: 8 +version: 9 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -21,9 +21,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2>&1*")) - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `impacket_lateral_movement_commandline_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -94,7 +98,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/impacket/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml index 5bc432054e..81af97bcc9 100644 --- a/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml @@ -1,6 +1,6 @@ name: Impacket Lateral Movement smbexec CommandLine Parameters id: bb3c1bac-6bdf-4aa0-8dc9-068b8b712a76 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,12 +19,15 @@ description: The following analytic identifies suspicious command-line parameter or further compromise of the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") AND match(process,"(?i)echo\s+cd") - AND match(process, "(?i)\\__output") AND match(process, "(?i)C:\\\\Windows\\\\[a-zA-Z]{1,8}\\.bat") AND - match(process, "\\\\127\.0\.0\.1\\.*") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `impacket_lateral_movement_smbexec_commandline_parameters_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") + AND match(process,"(?i)echo\s+cd") AND match(process, "(?i)\\__output") AND match(process, + "(?i)C:\\\\Windows\\\\[a-zA-Z]{1,8}\\.bat") AND match(process, "\\\\127\.0\.0\.1\\.*") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `impacket_lateral_movement_smbexec_commandline_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -95,7 +98,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/smbexec_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/smbexec_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml index 9e48d7ea19..b3b60e7a76 100644 --- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml @@ -1,6 +1,6 @@ name: Impacket Lateral Movement WMIExec Commandline Parameters id: d6e464e4-5c6a-474e-82d2-aed616a3a492 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,11 +19,14 @@ description: The following analytic detects the use of Impacket's `wmiexec.py` t leading to further compromise and data exfiltration. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") AND match(process, "\\\\127\.0\.0\.1\\.*") - AND match(process, "__\\d{1,10}\\.\\d{1,10}") | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `impacket_lateral_movement_wmiexec_commandline_parameters_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | where match(process, "(?i)cmd\.exe\s+\/Q\s+\/c") + AND match(process, "\\\\127\.0\.0\.1\\.*") AND match(process, "__\\d{1,10}\\.\\d{1,10}") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `impacket_lateral_movement_wmiexec_commandline_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -95,7 +98,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/wmiexec_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/wmiexec_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index 4e56391427..f92a2b63e4 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -1,6 +1,6 @@ name: Interactive Session on Remote Endpoint with PowerShell id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af -version: 8 +version: 9 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -16,13 +16,13 @@ description: The following analytic detects the use of the `Enter-PSSession` cmd data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-ComputerName*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `interactive_session_on_remote_endpoint_with_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions - can be found - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible. @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index 7c1a51343d..aa1648ca7b 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,6 +1,6 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -13,18 +13,39 @@ description: The following analytic detects the Java process writing a .jsp file this could allow unauthorized access, data exfiltration, or further compromise of the affected system, posing a severe security risk. data_source: -- Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.process_id - Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` - | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name="*.jsp*" by _time Filesystem.dest Filesystem.file_create_time - Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user - | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name - file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) - as lastTime by dest process_name process_guid file_name file_path file_create_time - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `java_writing_jsp_file_filter`' +- Sysmon for Linux EventID 1 AND Sysmon for Linux EventID 11 +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name + IN ("java","java.exe", "javaw.exe") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.jsp*" + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process) AND isnotnull(file_name) | + `java_writing_jsp_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` @@ -79,7 +100,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 8abf738b36..cce42fe195 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,6 +1,6 @@ name: Jscript Execution Using Cscript App id: 002f1e24-146e-11ec-a470-acde48001122 -version: 6 +version: 7 date: '2025-02-19' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name - = "cscript.exe" AND Processes.process = "*//e:jscript*") by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process_id Processes.process - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`' + = "cscript.exe" AND Processes.process = "*//e:jscript*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `jscript_execution_using_cscript_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml index 67814fc234..33a448a7e2 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml @@ -1,6 +1,6 @@ name: Kerberos Pre-Authentication Flag Disabled with PowerShell id: 59b51620-94c9-11ec-b3d5-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the use of the `Set-ADAccountControl data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Set-ADAccountControl*" AND - ScriptBlockText="*DoesNotRequirePreAuth:$true*") | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | rename Computer - as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`' + ScriptBlockText="*DoesNotRequirePreAuth:$true*") | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product + EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/kerberos_user_enumeration.yml b/detections/endpoint/kerberos_user_enumeration.yml index e5b80a4cea..fa46b59e32 100644 --- a/detections/endpoint/kerberos_user_enumeration.yml +++ b/detections/endpoint/kerberos_user_enumeration.yml @@ -1,6 +1,6 @@ name: Kerberos User Enumeration id: d82d4af4-a0bd-11ec-9445-3e22fbd008af -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -16,8 +16,8 @@ data_source: - Windows Event Log Security 4768 search: '`wineventlog_security` EventCode=4768 Status=0x6 TargetUserName!="*$" | bucket span=2m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as tried_accounts by _time, src_ip | eventstats avg(unique_accounts) as comp_avg - , stdev(unique_accounts) as comp_std by src_ip | eval upperBound=(comp_avg+comp_std*3) + as tried_accounts values(dest) as dest by _time, src_ip | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by src_ip | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1| `kerberos_user_enumeration_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1589.002/kerberos_user_enumeration/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1589.002/kerberos_user_enumeration/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml index 8728599618..821a725c09 100644 --- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml @@ -1,6 +1,6 @@ name: Linux Account Manipulation Of SSH Config and Keys id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted AND - Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by _time span=1h Filesystem.file_name - Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action | - `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_account_manipulation_of_ssh_config_and_keys_filter`' + Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_account_manipulation_of_ssh_config_and_keys_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index 7c5f666cd9..be6f5ef374 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -1,6 +1,6 @@ name: Linux Add Files In Known Crontab Directories id: 023f3452-5f27-11ec-bf00-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,10 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/cron*", - "*/var/spool/cron/*") by Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + "*/var/spool/cron/*") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_add_files_in_known_crontab_directories_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 3c798ae4cb..5835bb573b 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -1,6 +1,6 @@ name: Linux Add User Account id: 51fbcaf2-6259-11ec-b0f3-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name IN ("useradd", "adduser") OR Processes.process IN ("*useradd - *", "*adduser *") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`' + *", "*adduser *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -48,7 +51,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml index 7f05ba1ab8..4fcf7d3722 100644 --- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml +++ b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml @@ -1,6 +1,6 @@ name: Linux Adding Crontab Using List Parameter id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "crontab" - Processes.process= "* -l*" by Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_adding_crontab_using_list_parameter_filter`' + Processes.process= "* -l*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_adding_crontab_using_list_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -55,7 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index 0dd8a1971a..9895b29e2d 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux apt-get Privilege Escalation id: d870ce3b-e796-402f-b2af-cab4da1223f2 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt-get*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_apt_get_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt_get/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index b663f74c24..babfbc635b 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux APT Privilege Escalation id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*apt*" AND Processes.process="*APT::Update::Pre-Invoke::*" AND Processes.process="*sudo*" by - Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_apt_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/apt/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index ae556ae740..bd65b1cc65 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -1,6 +1,6 @@ name: Linux At Allow Config File Creation id: 977b3082-5f3d-11ec-b954-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/at.allow", - "*/etc/at.deny") by Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + "*/etc/at.deny") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 6666181369..c9d3e607ef 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -1,6 +1,6 @@ name: Linux At Application Execution id: bf0a378e-5f3c-11ec-a6de-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name IN ("at", "atd") OR Processes.parent_process_name - IN ("at", "atd") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' + IN ("at", "atd") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index 412b476eef..16e3efc231 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux AWK Privilege Escalation id: 4510cae0-96a2-4840-9919-91d262db210a -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*" AND - Processes.process="*awk*" AND Processes.process="*BEGIN*system*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`' + Processes.process="*awk*" AND Processes.process="*BEGIN*system*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_awk_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index 74ea49e117..b0d53fca9a 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Busybox Privilege Escalation id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*busybox*" - AND Processes.process="*sh*" AND Processes.process="*sudo*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_busybox_privilege_escalation_filter`' + AND Processes.process="*sh*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_busybox_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/busybox/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index 229db8dfc8..1423c3e674 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux c89 Privilege Escalation id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*c89*" AND - Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_c89_privilege_escalation_filter`' + Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_c89_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c89/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 6456f1654a..545fb0fa79 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux c99 Privilege Escalation id: e1c6dec5-2249-442d-a1f9-99a4bd228183 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*c99*" AND - Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_c99_privilege_escalation_filter`' + Processes.process="*-wrapper*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_c99_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/c99/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml index 0135aa468d..7492fb5e27 100644 --- a/detections/endpoint/linux_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_change_file_owner_to_root.yml @@ -1,6 +1,6 @@ name: Linux Change File Owner To Root id: c1400ea2-6257-11ec-ad49-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = chown - OR Processes.process = "*chown *") AND Processes.process = "* root *" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_change_file_owner_to_root_filter`' + OR Processes.process = "*chown *") AND Processes.process = "* root *" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_change_file_owner_to_root_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml index cfbfb74782..dd649b3b74 100644 --- a/detections/endpoint/linux_clipboard_data_copy.yml +++ b/detections/endpoint/linux_clipboard_data_copy.yml @@ -1,6 +1,6 @@ name: Linux Clipboard Data Copy id: 7173b2ad-6146-418f-85ae-c3479e4515fc -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,9 +17,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=xclip Processes.process IN ("*-o *", "*-sel *", "*-selection *", "*clip *","*clipboard*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_clipboard_data_copy_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_clipboard_data_copy_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index b823b6e94c..8f25bd671c 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -1,7 +1,7 @@ name: Linux Common Process For Elevation Control id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: '7' -date: '2025-02-24' +version: 8 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -22,10 +22,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "setregid", "chattr") OR Processes.process IN ("*chmod *", "*chown *", "*fchmod *", "*fchmodat *", "*fchown *", "*fchownat *", "*fremovexattr *", "*fsetxattr *", "*lchown *", "*lremovexattr *", "*lsetxattr *", "*removexattr *", "*setuid *", "*setgid - *", "*setreuid *", "*setregid *", "*setcap *", "*chattr *") by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`' + *", "*setreuid *", "*setregid *", "*setcap *", "*chattr *") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_common_process_for_elevation_control_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index d3303e4046..5b600e9955 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Composer Privilege Escalation id: a3bddf71-6ba3-42ab-a6b2-396929b16d92 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -18,10 +18,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*composer*" - AND Processes.process="*run-script*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_composer_privilege_escalation_filter`' + AND Processes.process="*run-script*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_composer_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/composer/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index 42c898b210..b5b8ca2c83 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Cpulimit Privilege Escalation id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,8 +17,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*cpulimit*" AND Processes.process="*-l*" AND Processes.process="*-f*" AND Processes.process="*sudo*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_cpulimit_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/cpulimit/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index 4c17cce459..1ce087b511 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Csvtool Privilege Escalation id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*csvtool*" - AND Processes.process="*call*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_csvtool_privilege_escalation_filter`' + AND Processes.process="*call*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_csvtool_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/csvtool/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml index eb53b86301..92bf73562d 100644 --- a/detections/endpoint/linux_curl_upload_file.yml +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -1,6 +1,6 @@ name: Linux Curl Upload File id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl Processes.process IN ("*-F *", "*--form *","*--upload-file *","*-T *","*-d *","*--data *","*--data-raw *", "*-I *", "*--head *") AND Processes.process IN ("*.aws/credentials*". - "*.aws/config*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_curl_upload_file_filter`' + "*.aws/config*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_curl_upload_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml index d995933ae4..ff5e6a8ae8 100644 --- a/detections/endpoint/linux_data_destruction_command.yml +++ b/detections/endpoint/linux_data_destruction_command.yml @@ -1,6 +1,6 @@ name: Linux Data Destruction Command id: b11d3979-b2f7-411b-bb1a-bd00e642173b -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "rm" AND Processes.process IN ("* -rf*", "* -fr*") AND Processes.process = "* --no-preserve-root" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_data_destruction_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index cf03a71a84..c05a4b3614 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -1,6 +1,6 @@ name: Linux DD File Overwrite id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dd" - AND Processes.process = "*of=*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_dd_file_overwrite_filter`' + AND Processes.process = "*of=*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_dd_file_overwrite_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index a332d7535a..2b8a8c3896 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -1,6 +1,6 @@ name: Linux Decode Base64 to Shell id: 637b603e-1799-40fd-bf87-47ecbd551b66 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*|*" `linux_shells` - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | rex field=process "base64\s+(?-{1,2}d\w*)" | where isnotnull(decode_flag) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_decode_base64_to_shell_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | rex field=process "base64\s+(?-{1,2}d\w*)" + | where isnotnull(decode_flag) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_decode_base64_to_shell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml index 2108f87769..dddd179d5e 100644 --- a/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml +++ b/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml @@ -1,6 +1,6 @@ name: Linux Deleting Critical Directory Using RM Command id: 33f89303-cc6f-49ad-921d-2eaea38a6f7a -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name =rm AND Processes.process= "* -rf *" AND Processes.process IN ("*/boot/*", "*/var/log/*", - "*/etc/*", "*/dev/*") by Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_deleting_critical_directory_using_rm_command_filter`' + "*/etc/*", "*/dev/*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_deleting_critical_directory_using_rm_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index 0e75efa4a7..514ac78d41 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -1,6 +1,6 @@ name: Linux Deletion Of Cron Jobs id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,11 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path="/etc/cron.*" - by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid - Filesystem.action | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_deletion_of_cron_jobs_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_deletion_of_cron_jobs_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 339d58c50b..9b0914b54f 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -1,6 +1,6 @@ name: Linux Deletion Of Init Daemon Script id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,10 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path - IN ( "/etc/init.d/*") by _time span=1h Filesystem.file_name Filesystem.file_path - Filesystem.dest Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` + IN ( "/etc/init.d/*") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_deletion_of_init_daemon_script_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 2d27e43f5b..68f20f6650 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -1,6 +1,6 @@ name: Linux Deletion Of Services id: b509bbd3-0331-4aaa-8e4a-d2affe100af6 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "*/lib/systemd/*", "*/run/systemd/*") Filesystem.file_path - = "*.service" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_deletion_of_services_filter`' + = "*.service" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_deletion_of_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 94765cb179..50a9168bf4 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -1,6 +1,6 @@ name: Linux Deletion of SSL Certificate id: 839ab790-a60a-4f81-bfb3-02567063f615 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path - = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") by _time span=1h - Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid - Filesystem.action | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") by Filesystem.action + Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash + Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user + Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_deletion_of_ssl_certificate_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_disable_services.yml b/detections/endpoint/linux_disable_services.yml index 61d16f3040..6cefcdf8d1 100644 --- a/detections/endpoint/linux_disable_services.yml +++ b/detections/endpoint/linux_disable_services.yml @@ -1,6 +1,6 @@ name: Linux Disable Services id: f2e08a38-6689-4df4-ad8c-b51c16262316 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("systemctl", - "service", "svcadm") Processes.process = "* disable*" by Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_disable_services_filter`' + "service", "svcadm") Processes.process = "* disable*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_disable_services_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml index 8dfac80ecc..877db6be69 100644 --- a/detections/endpoint/linux_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -1,6 +1,6 @@ name: Linux Doas Conf File Creation id: f6343e86-6e09-11ec-9376-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,11 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/doas.conf") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid - Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `linux_doas_conf_file_creation_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_doas_conf_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml index 24876440f0..18db34ff3c 100644 --- a/detections/endpoint/linux_doas_tool_execution.yml +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -1,6 +1,6 @@ name: Linux Doas Tool Execution id: d5a62490-6e09-11ec-884e-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,11 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "doas" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_doas_tool_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index 6a3293283f..a612101c5b 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Docker Privilege Escalation id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN("*docker*-v*/*:*","*docker*--volume*/*:*") - OR Processes.process IN("*docker*exec*sh*","*docker*exec*bash*") by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`' + OR Processes.process IN("*docker*exec*sh*","*docker*exec*bash*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_docker_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index 6da604bda5..d9d9084f78 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -1,6 +1,6 @@ name: Linux Edit Cron Table Parameter id: 0d370304-5f26-11ec-a4bb-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = crontab - Processes.process = "*crontab *" Processes.process = "* -e*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`' + Processes.process = "*crontab *" Processes.process = "* -e*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_edit_cron_table_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index 3e44cdc17f..5205f16866 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Emacs Privilege Escalation id: 92033cab-1871-483d-a03b-a7ce98665cfc -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*emacs*" - AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_emacs_privilege_escalation_filter`' + AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_emacs_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/emacs/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml index 1335c47856..f3acbffb3c 100644 --- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml +++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml @@ -1,6 +1,6 @@ name: Linux File Created In Kernel Driver Directory id: b85bbeec-6326-11ec-9311-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,11 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/kernel/drivers/*") - by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `linux_file_created_in_kernel_driver_directory_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_file_created_in_kernel_driver_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 143c90cbbc..f4bd0743b4 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -1,7 +1,7 @@ name: Linux File Creation In Init Boot Directory id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -version: '8' -date: '2025-02-24' +version: 9 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,9 +16,12 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/init.d/*", - "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") by Filesystem.dest Filesystem.file_name - Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_file_creation_in_init_boot_directory_filter`' + "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `linux_file_creation_in_init_boot_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index d42712cf76..67eea7cecc 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -1,6 +1,6 @@ name: Linux File Creation In Profile Directory id: 46ba0082-61af-11ec-9826-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,11 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/profile.d/*") - by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid - Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `linux_file_creation_in_profile_directory_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_file_creation_in_profile_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index 6f3280fbc7..7562dfe549 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Find Privilege Escalation id: 2ff4e0c2-8256-4143-9c07-1e39c7231111 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*find*" AND - Processes.process="*-exec*" AND Processes.process="*sudo*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_find_privilege_escalation_filter`' + Processes.process="*-exec*" AND Processes.process="*sudo*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_find_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/find/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index ac12b85551..f31c966f9c 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux GDB Privilege Escalation id: 310b7da2-ab52-437f-b1bf-0bd458674308 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,8 +17,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*gdb*" AND Processes.process="*-nx*" AND Processes.process="*-ex*!*" AND Processes.process="*sudo*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_gdb_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gdb/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index ad933d3de7..ebdfbdd8ba 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Gem Privilege Escalation id: 0115482a-5dcb-4bb0-bcca-5d095d224236 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*gem*open*-e*" - AND Processes.process="*-c*" AND Processes.process="*sudo*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_gem_privilege_escalation_filter`' + AND Processes.process="*-c*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_gem_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gem/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 2b34220074..9f39825b7d 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux GNU Awk Privilege Escalation id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -16,10 +16,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*gawk*" AND - Processes.process="*BEGIN*{system*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `linux_gnu_awk_privilege_escalation_filter`' + Processes.process="*BEGIN*{system*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_gnu_awk_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/gawk/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_hardware_addition_swapoff.yml b/detections/endpoint/linux_hardware_addition_swapoff.yml index be49f67540..81a67e00b3 100644 --- a/detections/endpoint/linux_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_hardware_addition_swapoff.yml @@ -1,6 +1,6 @@ name: Linux Hardware Addition SwapOff id: c1eea697-99ed-44c2-9b70-d8935464c499 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,11 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "swapoff" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_hardware_addition_swapoff_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index cdde6977e4..3582ce15ef 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -1,6 +1,6 @@ name: Linux High Frequency Of File Deletion In Boot Folder id: e27fbc5d-0445-4c4a-bc39-87f060d5c602 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -14,12 +14,17 @@ description: The following analytic detects a high frequency of file deletions i causing a complete system compromise. data_source: - Sysmon for Linux EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as - deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) - as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.action=deleted Filesystem.file_path = "/boot/*" by _time span=1h Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | - where numOfDelFilePath >= 200 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` values(Filesystem.file_access_time) + as file_access_time values(Filesystem.file_create_time) as file_create_time values(Filesystem.file_hash) + as file_hash values(Filesystem.file_modify_time) as file_modify_time values(Filesystem.file_name) + as file_name values(Filesystem.file_path) as file_path values(Filesystem.file_acl) + as file_acl values(Filesystem.file_size) as file_size values(Filesystem.process_id) + as process_id values(Filesystem.user) as user values(Filesystem.vendor_product) + as vendor_product dc(Filesystem.file_path) as numOfDelFilePath count min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted + Filesystem.file_path = "/boot/*" by _time span=1h Filesystem.dest Filesystem.process_guid + Filesystem.action | `drop_dm_object_name(Filesystem)` | where numOfDelFilePath + >= 200 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -68,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index ae5aa85d0d..fefeca16fb 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -1,6 +1,6 @@ name: Linux High Frequency Of File Deletion In Etc Folder id: 9d867448-2aff-4d07-876c-89409a752ff8 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -14,12 +14,16 @@ description: The following analytic detects a high frequency of file deletions i data loss, and potential disruption of services. data_source: - Sysmon for Linux EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as - deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) - as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +search: '| tstats `security_content_summariesonly` values(Filesystem.file_access_time) + as file_access_time values(Filesystem.file_create_time) as file_create_time values(Filesystem.file_hash) + as file_hash values(Filesystem.file_modify_time) as file_modify_time values(Filesystem.file_name) + as file_name values(Filesystem.file_path) as file_path values(Filesystem.file_acl) + as file_acl values(Filesystem.file_size) as file_size values(Filesystem.process_id) + as process_id values(Filesystem.user) as user dc(Filesystem.file_path) as numOfDelFilePath + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/etc/*" by _time span=1h Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | - where numOfDelFilePath >= 200 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Filesystem.process_guid Filesystem.action Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | where numOfDelFilePath >= 200 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -66,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_impair_defenses_process_kill.yml b/detections/endpoint/linux_impair_defenses_process_kill.yml index 6662f54760..e512177018 100644 --- a/detections/endpoint/linux_impair_defenses_process_kill.yml +++ b/detections/endpoint/linux_impair_defenses_process_kill.yml @@ -1,6 +1,6 @@ name: Linux Impair Defenses Process Kill id: 435c6b33-adf9-47fe-be87-8e29fd6654f5 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ( - "pgrep", "pkill") Processes.process = "*pkill *" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `linux_impair_defenses_process_kill_filter`' + "pgrep", "pkill") Processes.process = "*pkill *" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_impair_defenses_process_kill_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_indicator_removal_clear_cache.yml b/detections/endpoint/linux_indicator_removal_clear_cache.yml index c775e76997..bbdf324a94 100644 --- a/detections/endpoint/linux_indicator_removal_clear_cache.yml +++ b/detections/endpoint/linux_indicator_removal_clear_cache.yml @@ -1,6 +1,6 @@ name: Linux Indicator Removal Clear Cache id: e0940505-0b73-4719-84e6-cb94c44a5245 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("dash", "sudo", "bash") AND Processes.process IN("* echo 3 > *", "* echo 2 > *","* - echo 1 > *") AND Processes.process = "*/proc/sys/vm/drop_caches" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `linux_indicator_removal_clear_cache_filter`' + echo 1 > *") AND Processes.process = "*/proc/sys/vm/drop_caches" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_indicator_removal_clear_cache_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test3/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test3/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml index de2d2e6acb..54f1c79236 100644 --- a/detections/endpoint/linux_indicator_removal_service_file_deletion.yml +++ b/detections/endpoint/linux_indicator_removal_service_file_deletion.yml @@ -1,6 +1,6 @@ name: Linux Indicator Removal Service File Deletion id: 6c077f81-2a83-4537-afbc-0e62e3215d55 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "rm" AND - Processes.process = "*rm *" AND Processes.process = "*.service" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `linux_indicator_removal_service_file_deletion_filter`' + Processes.process = "*rm *" AND Processes.process = "*.service" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_indicator_removal_service_file_deletion_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test1/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index 488c3e3cfd..f55531f5da 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -1,6 +1,6 @@ name: Linux Ingress Tool Transfer Hunting id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf -version: 6 +version: 7 date: '2024-12-19' author: Michael Haag, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=curl - OR Processes.process_name=wget) by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_ingress_tool_transfer_hunting_filter`' + OR Processes.process_name=wget) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ingress_tool_transfer_hunting_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -53,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml index e21c8f57e5..c65698ec65 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -1,6 +1,6 @@ name: Linux Ingress Tool Transfer with Curl id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 -version: 6 +version: 7 date: '2024-12-19' author: Michael Haag, Splunk status: production @@ -16,10 +16,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where - match(process, "(?i)(-O|-sO|-ksO|--output)") | `linux_ingress_tool_transfer_with_curl_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | where match(process, "(?i)(-O|-sO|-ksO|--output)") | `linux_ingress_tool_transfer_with_curl_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index fc543070b2..06ad099dae 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -1,6 +1,6 @@ name: Linux Insert Kernel Module Using Insmod Utility id: 18b5a1a0-6326-11ec-943a-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("kmod", - "sudo") AND Processes.process = *insmod* by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_insert_kernel_module_using_insmod_utility_filter`' + "sudo") AND Processes.process = *insmod* by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_insert_kernel_module_using_insmod_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml index 32b16133a8..0bff02e5dc 100644 --- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml @@ -1,6 +1,6 @@ name: Linux Install Kernel Module Using Modprobe Utility id: 387b278a-6326-11ec-aa2c-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("kmod", - "sudo") AND Processes.process = *modprobe* by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`' + "sudo") AND Processes.process = *modprobe* by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 9b1d5a8d69..99ef55895e 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: '9' -date: '2025-02-24' +version: 10 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -20,14 +20,16 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name - Processes.parent_process_path Processes.process_path | rex field=Processes.process - "--dport (?3269|636|989|994|995|8443)" | stats values(Processes.process) as - processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) - as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name - Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path - Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" | stats + values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) + as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name + Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user + Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index a13f0d306e..41534f6458 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -1,6 +1,6 @@ name: Linux Java Spawning Shell id: 7b09db8a-5c20-11ec-9945-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,9 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java OR Processes.parent_process_name=apache OR Processes.parent_process_name=tomcat - `linux_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_spawning_shell_filter`' + `linux_shells` by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_java_spawning_shell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/java_spawn_shell_nix.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/java_spawn_shell_nix.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 157f255449..9d6426bb96 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -1,6 +1,6 @@ name: Linux Kernel Module Enumeration id: 6df99886-0e04-4c11-8b88-325747419278 -version: 7 +version: 8 date: '2024-11-17' author: Michael Haag, Splunk status: production @@ -16,10 +16,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=kmod - Processes.process IN ("*lsmod*", "*list*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_kernel_module_enumeration_filter`' + Processes.process IN ("*lsmod*", "*list*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kernel_module_enumeration_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml index 6f189c9c75..d3ab7cd0db 100644 --- a/detections/endpoint/linux_kworker_process_in_writable_process_path.yml +++ b/detections/endpoint/linux_kworker_process_in_writable_process_path.yml @@ -1,6 +1,6 @@ name: Linux Kworker Process In Writable Process Path id: 1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,11 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process = "*[kworker/*" Processes.parent_process_path IN ("/home/*", "/tmp/*", "/var/log/*") - Processes.process="*iptables*" by Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_path Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_kworker_process_in_writable_process_path_filter`' + Processes.process="*iptables*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_kworker_process_in_writable_process_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index 8167787558..deafa857a7 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Make Privilege Escalation id: 80b22836-5091-4944-80ee-f733ac443f4f -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -16,10 +16,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*make*-s*" - AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_make_privilege_escalation_filter`' + AND Processes.process="*--eval*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_make_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/make/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index 4fc1ec1c2a..a95a6b4dca 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux MySQL Privilege Escalation id: c0d810f4-230c-44ea-b703-989da02ff145 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*mysql*-e*" - AND Processes.process="*\!**" AND Processes.process="*sudo*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_mysql_privilege_escalation_filter`' + AND Processes.process="*\!**" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_mysql_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/mysql/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml index ace58aa7ad..0becd41915 100644 --- a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml @@ -1,6 +1,6 @@ name: Linux Ngrok Reverse Proxy Usage id: bc84d574-708c-467d-b78a-4c1e20171f97 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,8 +17,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ngrok Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", - "*tcp*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + "*tcp*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ngrok_reverse_proxy_usage_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/ngrok_linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/ngrok_linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index de6c9fa5c1..2644522fbc 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Node Privilege Escalation id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*node*" AND Processes.process="*-e*" AND Processes.process="*child_process.spawn*" AND Processes.process="*stdio*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 90563b48db..fffdf4fa11 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux NOPASSWD Entry In Sudoers File id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: '7' -date: '2025-02-24' +version: 8 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -17,8 +17,11 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*NOPASSWD:*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_nopasswd_entry_in_sudoers_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index eeb2fe21ba..5598bf79db 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -1,6 +1,6 @@ name: Linux Obfuscated Files or Information Base64 Decode id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -16,10 +16,12 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path="*/base64" - Processes.process="*-d*" by Processes.process Processes.dest Processes.process_current_directory - Processes.process_name Processes.process_integrity_level Processes.parent_process_name - Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id - Processes.process_guid Processes.process_id Processes.user | `drop_dm_object_name(Processes)` + Processes.process="*-d*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_obfuscated_files_or_information_base64_decode_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -79,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index ac9ee41409..71cfa1c78d 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Octave Privilege Escalation id: 78f7487d-42ce-4f7f-8685-2159b25fb477 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*octave-cli*" AND Processes.process="*--eval*" AND Processes.process="*system*" AND Processes.process="*sudo*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_octave_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/octave/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index 721061b734..6200029b27 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux OpenVPN Privilege Escalation id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -18,10 +18,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*openvpn*" AND Processes.process="*--dev*" AND Processes.process="*--script-security*" AND - Processes.process="*--up*" AND Processes.process="*sudo*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_openvpn_privilege_escalation_filter`' + Processes.process="*--up*" AND Processes.process="*sudo*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_openvpn_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/openvpn/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index d65dc8062b..744038f95e 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux PHP Privilege Escalation id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*php*-r*" - AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_php_privilege_escalation_filter`' + AND Processes.process="*system*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_php_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/php/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml index 81844e155e..41fe9ac26b 100644 --- a/detections/endpoint/linux_pkexec_privilege_escalation.yml +++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux pkexec Privilege Escalation id: 03e22c1c-8086-11ec-ac2e-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -16,10 +16,14 @@ description: The following analytic detects the execution of `pkexec` without an data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=pkexec by _time Processes.dest Processes.user Processes.process_id - Processes.parent_process_name Processes.process_name Processes.process Processes.process_path - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(^.{1}$)" | `linux_pkexec_privilege_escalation_filter`' + where Processes.process_name=pkexec by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex + process="(^.{1}$)" | `linux_pkexec_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/pkexec/linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/pkexec/linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml index 99ccd2b813..9a24efeff3 100644 --- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml @@ -1,6 +1,6 @@ name: Linux Possible Access Or Modification Of sshd Config File id: 7a85eb24-72da-11ec-ac76-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat", - "nano*","vim*", "vi*") AND Processes.process IN("*/etc/ssh/sshd_config") by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_or_modification_of_sshd_config_file_filter`' + "nano*","vim*", "vi*") AND Processes.process IN("*/etc/ssh/sshd_config") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_possible_access_or_modification_of_sshd_config_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index 14a2fe0df1..594cbc6f4b 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Credential Files id: 16107e0e-71fc-11ec-b862-acde48001122 -version: '8' -date: '2025-02-24' +version: 9 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -17,9 +17,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat", "nano*","vim*", "vi*") AND Processes.process IN("*/etc/shadow*", "*/etc/passwd*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_possible_access_to_credential_files_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index b9936bb72e..a430dc63b1 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Sudoers File id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: '7' -date: '2025-02-24' +version: 8 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,10 +16,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat", - "nano*","vim*", "vi*") AND Processes.process IN("*/etc/sudoers*") by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`' + "nano*","vim*", "vi*") AND Processes.process IN("*/etc/sudoers*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_possible_access_to_sudoers_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 484cd366c6..320796d11b 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -1,6 +1,6 @@ name: Linux Possible Append Command To At Allow Config File id: 7bc20606-5f40-11ec-a586-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,11 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process = "*echo*" AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_append_command_to_at_allow_config_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index d003d753b3..6716db4274 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -1,6 +1,6 @@ name: Linux Possible Append Command To Profile Config File id: 9c94732a-61af-11ec-91e3-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*echo*" AND Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", - "*~/.profile", "~/.bash_logout") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_possible_append_command_to_profile_config_file_filter`' + "*~/.profile", "~/.bash_logout") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_append_command_to_profile_config_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 419ae58634..efa52f8e37 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -1,6 +1,6 @@ name: Linux Possible Append Cronjob Entry on Existing Cronjob File id: b5b91200-5f27-11ec-bb4e-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process = "*echo*" AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*", - "*/etc/anacrontab*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' + "*/etc/anacrontab*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -55,7 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index 2b2ebb78dc..36063bd09a 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -1,6 +1,6 @@ name: Linux Possible Cronjob Modification With Editor id: dcc89bde-5f24-11ec-87ca-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN("nano","vim.basic") OR Processes.process IN ("*nano *", "*vi *", "*vim *")) AND Processes.process IN("*/etc/cron*", - "*/var/spool/cron/*", "*/etc/anacrontab*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_possible_cronjob_modification_with_editor_filter`' + "*/var/spool/cron/*", "*/etc/anacrontab*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_cronjob_modification_with_editor_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -52,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml index 63df17e210..4e67b177ff 100644 --- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml +++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml @@ -1,6 +1,6 @@ name: Linux Possible Ssh Key File Creation id: c04ef40c-72da-11ec-8eac-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,11 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/.ssh*") - by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `linux_possible_ssh_key_file_creation_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_possible_ssh_key_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index 1d2059864e..1fb96b33be 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Preload Hijack Library Calls id: cbe2ca30-631e-11ec-8670-acde48001122 -version: '7' -date: '2025-02-24' +version: 8 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -17,8 +17,11 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*LD_PRELOAD*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_preload_hijack_library_calls_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml index 75268921b8..82960aa1a4 100644 --- a/detections/endpoint/linux_proxy_socks_curl.yml +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -1,7 +1,7 @@ name: Linux Proxy Socks Curl id: bd596c22-ad1e-44fc-b242-817253ce8b08 -version: 7 -date: '2025-02-19' +version: 8 +date: '2025-03-27' author: Michael Haag, Splunk, 0xC0FFEEEE, Github Community status: production type: TTP @@ -18,10 +18,15 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl Processes.process IN ("*-x *", "*socks4a://*", "*socks5h://*", "*socks4://*","*socks5://*", - "*--preproxy *", "--proxy*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | where match(process, "-x\s") OR match(process, "(?i)socks\d\w?:\/\/|--(pre)?proxy") | `linux_proxy_socks_curl_filter`' + "*--preproxy *", "--proxy*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where + match(process, "-x\s") OR match(process, "(?i)socks\d\w?:\/\/|--(pre)?proxy") | + `linux_proxy_socks_curl_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index b6a4422129..45923ebdd0 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Puppet Privilege Escalation id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -18,10 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*puppet*" AND Processes.process="*apply*" AND Processes.process="*-e*" AND Processes.process="*exec*" - AND Processes.process="*sudo*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`' + AND Processes.process="*sudo*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_puppet_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/puppet/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index 8f3021760f..2b91858e2f 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux RPM Privilege Escalation id: f8e58a23-cecd-495f-9c65-6c76b4cb9774 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*rpm*--eval*" - AND Processes.process="*lua:os.execute*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_rpm_privilege_escalation_filter`' + AND Processes.process="*lua:os.execute*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_rpm_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/rpm/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index 42301ecd19..f96f0cf831 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Ruby Privilege Escalation id: 097b28b5-7004-4d40-a715-7e390501788b -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -16,10 +16,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*ruby*-e*" - AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ruby_privilege_escalation_filter`' + AND Processes.process="*exec*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_ruby_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/ruby/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml index 84f9f74176..1b206345ab 100644 --- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -1,6 +1,6 @@ name: Linux Service File Created In Systemd Directory id: c7495048-61b6-11ec-9a37-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name = *.service Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", - "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") by Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `linux_service_file_created_in_systemd_directory_filter`' + "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") by Filesystem.action + Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash + Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user + Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `linux_service_file_created_in_systemd_directory_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index e38b12f9c0..5dddaf2ff5 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -1,6 +1,6 @@ name: Linux Service Restarted id: 084275ba-61b8-11ec-8d64-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process - IN ("*restart*", "*reload*", "*reenable*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' + IN ("*restart*", "*reload*", "*reenable*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml index c5ee30eed0..eb4540f530 100644 --- a/detections/endpoint/linux_service_started_or_enabled.yml +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -1,6 +1,6 @@ name: Linux Service Started Or Enabled id: e0428212-61b7-11ec-88a3-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,8 +19,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process IN ("* start *", "* enable *") AND NOT (Processes.os="Microsoft Windows" OR Processes.vendor_product="Microsoft - Windows") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + Windows") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 91fc08356f..e336113516 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -1,6 +1,6 @@ name: Linux Setuid Using Chmod Utility id: bf0304b6-6250-11ec-9d7c-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *", - "* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`' + "* 4777 *", "* 4577 *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index 55265c8fdf..e79ff07948 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -1,6 +1,6 @@ name: Linux Setuid Using Setcap Utility id: 9d96022e-6250-11ec-9a19-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,8 +19,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = setcap OR Processes.process = "*setcap *") AND Processes.process IN ("* cap_setuid=ep *", "* cap_setuid+ep *", "* cap_net_bind_service+p *", "* cap_net_raw+ep *", "* cap_dac_read_search+ep - *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_setuid_using_setcap_utility_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_shred_overwrite_command.yml b/detections/endpoint/linux_shred_overwrite_command.yml index 9906adaea1..e6133b9728 100644 --- a/detections/endpoint/linux_shred_overwrite_command.yml +++ b/detections/endpoint/linux_shred_overwrite_command.yml @@ -1,6 +1,6 @@ name: Linux Shred Overwrite Command id: c1952cf1-643c-4965-82de-11c067cbae76 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name =shred - AND Processes.process IN ("*-n*", "*-u*", "*-z*", "*-s*") by Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_shred_overwrite_command_filter`' + AND Processes.process IN ("*-n*", "*-u*", "*-z*", "*-s*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_shred_overwrite_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index 276443066d..cf2c554285 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Sqlite3 Privilege Escalation id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1 -version: 7 +version: 8 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*sqlite3*" - AND Processes.process="*.shell*" AND Processes.process="*sudo*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sqlite3_privilege_escalation_filter`' + AND Processes.process="*.shell*" AND Processes.process="*sudo*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_sqlite3_privilege_escalation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/sqlite3/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index d513ccb7c5..1f924b5398 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -1,6 +1,6 @@ name: Linux SSH Authorized Keys Modification id: f5ab595e-28e5-4327-8077-5008ba97c850 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("bash","cat") - Processes.process IN ("*/authorized_keys*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `linux_ssh_authorized_keys_modification_filter`' + Processes.process IN ("*/authorized_keys*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_ssh_authorized_keys_modification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index cddd81fa59..7824769931 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -1,6 +1,6 @@ name: Linux SSH Remote Services Script Execute id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ssh Processes.process IN ("*oStrictHostKeyChecking*", "*oConnectTimeout*", "*oBatchMode*") - AND Processes.process IN ("*http:*","*https:*") by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `linux_ssh_remote_services_script_execute_filter`' + AND Processes.process IN ("*http:*","*https:*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_ssh_remote_services_script_execute_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml index 07665db54f..cb04265156 100644 --- a/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml +++ b/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml @@ -1,6 +1,6 @@ name: Linux Stdout Redirection To Dev Null File id: de62b809-a04d-46b5-9a15-8298d330f0c8 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: experimental @@ -17,8 +17,11 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*&>/dev/null*" - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid Processes.dest Processes.user Processes.parent_process_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stdout_redirection_to_dev_null_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -57,7 +60,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_stop_services.yml b/detections/endpoint/linux_stop_services.yml index ba2750e653..a0ee4de926 100644 --- a/detections/endpoint/linux_stop_services.yml +++ b/detections/endpoint/linux_stop_services.yml @@ -1,6 +1,6 @@ name: Linux Stop Services id: d05204a5-9f1c-4946-a7f3-4fa58d76d5fd -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("systemctl", - "service", "svcadm") Processes.process ="*stop*" by Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_stop_services_filter`' + "service", "svcadm") Processes.process ="*stop*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_stop_services_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml index da149584d5..255f1338e2 100644 --- a/detections/endpoint/linux_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -1,6 +1,6 @@ name: Linux Sudo OR Su Execution id: 4b00f134-6d6a-11ec-a90c-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,14 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("sudo", - "su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`' + "su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_sudo_or_su_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -49,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index ca24f2680e..0c994d9040 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Sudoers Tmp File Creation id: be254a5c-63e7-11ec-89da-acde48001122 -version: '7' -date: '2025-02-24' +version: 8 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -17,9 +17,11 @@ data_source: - Sysmon for Linux EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*sudoers.tmp*") - by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `linux_sudoers_tmp_file_creation_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_sudoers_tmp_file_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 26d64b1efc..45f20262ec 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -1,6 +1,6 @@ name: Linux System Network Discovery id: 535cb214-8b47-11ec-a2c7-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,14 +15,23 @@ description: The following analytic identifies potential enumeration of local ne movement within the environment. data_source: - Sysmon for Linux EventID 1 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) - as process_name_list values(Processes.process) as process_list values(Processes.process_id) - as process_id_list values(Processes.parent_process_id) as parent_process_id_list - values(Processes.process_guid) as process_guid_list dc(Processes.process_name) as +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.action) as action values(Processes.dest) as dest values(Processes.original_file_name) + as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) + as parent_process_name values(Processes.parent_process_path) as parent_process_path + values(Processes.process) as process values(Processes.process_exec) as process_exec + values(Processes.process_guid) as process_guid values(Processes.process_hash) as + process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) + as process_path values(Processes.user) as user values(Processes.user_id) as user_id + values(Processes.vendor_product) as vendor_product dc(Processes.process_name) as process_name_count from datamodel=Endpoint.Processes where Processes.process_name IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", - "route") by _time span=30m Processes.dest Processes.user | where process_name_count - >=4 | `drop_dm_object_name(Processes)`| `linux_system_network_discovery_filter`' + "route") by _time span=30m Processes.dest Processes.user | where process_name_count>=4 + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_system_network_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +60,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Network discovery process $process_name_list$ executed on $dest$ + message: Network discovery process $process$ executed on $dest$ risk_objects: - field: dest type: system @@ -73,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml index dbf98825e2..64f4ea261c 100644 --- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml +++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml @@ -1,6 +1,6 @@ name: Linux System Reboot Via System Request Key id: e1912b58-ed9c-422c-bbb0-2dbc70398345 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("dash", "sudo", "bash") Processes.process = "* echo b > *" Processes.process = "*/proc/sysrq-trigger" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_system_reboot_via_system_request_key_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test2/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test2/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml index d183c538ae..e23c928276 100644 --- a/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml +++ b/detections/endpoint/linux_unix_shell_enable_all_sysrq_functions.yml @@ -1,6 +1,6 @@ name: Linux Unix Shell Enable All SysRq Functions id: e7a96937-3b58-4962-8dce-538e4763cf15 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("dash", "sudo", "bash") Processes.process = "* echo 1 > *" Processes.process = "*/proc/sys/kernel/sysrq" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_unix_shell_enable_all_sysrq_functions_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test2/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/awfulshred/test2/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml index 596d9a84c3..ed3255c267 100644 --- a/detections/endpoint/linux_visudo_utility_execution.yml +++ b/detections/endpoint/linux_visudo_utility_execution.yml @@ -1,6 +1,6 @@ name: Linux Visudo Utility Execution id: 08c41040-624c-11ec-a71f-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,11 @@ data_source: - Sysmon for Linux EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = visudo - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_visudo_utility_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index b84f0b040e..4e5e9bac04 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -1,6 +1,6 @@ name: Loading Of Dynwrapx Module id: eac5e8ba-4857-11ec-9371-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,11 @@ description: The following analytic detects the loading of the dynwrapx.dll modu data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName - = "dynwrapx.dll" OR Product = "DynamicWrapperX") | stats count min(_time) as firstTime - max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name - dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + = "dynwrapx.dll" OR Product = "DynamicWrapperX") | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path + original_file_name process_exec process_guid process_hash process_id process_name + process_path service_dll_signature_exists service_dll_signature_verified signature + signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `loading_of_dynwrapx_module_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index 85b07244d2..5ccada90a9 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -1,6 +1,6 @@ name: Local Account Discovery With Wmic id: 4902d7aa-0134-11ec-9d65-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `local_account_discovery_with_wmic_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -48,7 +52,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index b27836b375..a34a57233f 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -1,6 +1,6 @@ name: Logon Script Event Trigger Execution id: 4c38c264-1f74-11ec-b5fa-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` + IN ("*\\Environment\\UserInitMprLogonScript") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -70,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/endpoint/lolbas_with_network_traffic.yml index 785a6006ef..6531760b46 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/endpoint/lolbas_with_network_traffic.yml @@ -1,6 +1,6 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 -version: 6 +version: 7 date: '2024-12-16' author: Steven Dick status: production @@ -28,9 +28,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*Wmic.exe", "*Runonce.exe", "*Syncappvpublishingserver.exe", "*Verclsid.exe", "*Infdefaultinstall.exe", "*Installutil.exe", "*Netsh.exe", "*Wab.exe", "*Dnscmd.exe", "*\\At.exe", "*Pcalua.exe", "*Msconfig.exe", "*makecab.exe", "*cscript.exe", "*notepad.exe", "*\\cmd.exe", "*certutil.exe", - "*\\powershell.exe", "*powershell_ise.exe", "*\\pwsh.exe")) by All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user,All_Traffic.dest,All_Traffic.dest_ip + "*\\powershell.exe", "*powershell_ise.exe", "*\\pwsh.exe")) by All_Traffic.action + All_Traffic.app All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction + All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src + All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rex field=app ".*\\\(?.*)$" | rename app as process | `lolbas_with_network_traffic_filter`' + | rex field=app ".*\\\(?.*)$" | `lolbas_with_network_traffic_filter`' how_to_implement: To successfully implement this detection you must ingest events into the Network traffic data model that contain the source, destination, and communicating process in the app field. Relevant processes must also be ingested in the Endpoint @@ -38,8 +41,7 @@ how_to_implement: To successfully implement this detection you must ingest event of this type this data type. known_false_positives: Legitimate usage of internal automation or scripting, especially powershell.exe or pwsh.exe, internal to internal or logon scripts. It may be necessary - to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN - ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1") + to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1") references: - https://lolbas-project.github.io/# - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ @@ -82,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 63412c881e..7551b9fcfa 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -1,6 +1,6 @@ name: Mailsniper Invoke functions id: a36972c8-b894-11eb-9f78-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,10 @@ search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365Mail "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename Computer as dest | rename UserID as user - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `mailsniper_invoke_functions_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -28,13 +29,13 @@ known_false_positives: unknown references: - https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -42,12 +43,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Potential mailsniper.ps1 functions executed on dest $dest$ by user $user$. + message: Potential mailsniper.ps1 functions executed on dest $dest$ by user $user_id$. risk_objects: - field: dest type: system score: 72 - - field: user + - field: user_id type: user score: 72 threat_objects: [] @@ -65,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index d6476bf1a3..e88d82648d 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -1,6 +1,6 @@ name: Malicious InProcServer32 Modification id: 127c8d08-25ff-11ec-9223-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -13,19 +13,15 @@ description: The following analytic detects a process modifying the registry wit malicious, this could allow an attacker to persist in the environment, execute arbitrary code, or escalate privileges, posing a severe threat to system integrity and security. data_source: -- Sysmon EventID 1 AND Sysmon EventID 12 -- Sysmon EventID 1 AND Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid - Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats - `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= - "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by - Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest - Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` | fields _time - dest registry_path registry_key_name registry_value_name process_name process_path - process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime - by dest, process_name registry_path registry_key_name registry_value_name user | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`' +- Sysmon EventID 12 +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where Registry.registry_path="*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `malicious_inprocserver32_modification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -58,15 +54,13 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The $process_name$ was identified on endpoint $dest$ modifying the registry - with a known malicious clsid under InProcServer32. + message: A process identified on endpoint $dest$ modifying the registry with a known + malicious clsid under InProcServer32. risk_objects: - field: dest type: system score: 80 - threat_objects: - - field: process_name - type: process_name + threat_objects: [] tags: analytic_story: - Suspicious Regsvr32 Activity @@ -83,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 23f7cc2670..412f4fba4e 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -1,6 +1,6 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -version: 12 +version: 13 date: '2024-11-22' author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community status: production @@ -18,12 +18,17 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user - Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name - Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|–|—|―][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\s+[\"]?[A-Za-z0-9+/=]{5,}[\"]?") - | `malicious_powershell_process___encoded_command_filter`' +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ + \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.action\ + \ Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec\ + \ Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name\ + \ Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid\ + \ Processes.process_hash Processes.process_id Processes.process_integrity_level\ + \ Processes.process_name Processes.process_path Processes.user Processes.user_id\ + \ Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ + \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ + |\u2014|\u2015][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\\s+[\\\"]?[A-Za-z0-9+/=]{5,}[\\\"]?\"\ + ) | `malicious_powershell_process___encoded_command_filter`" how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -66,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 5051787f4a..32757b4ae4 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,6 +1,6 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: '11' +version: '12' date: '2025-02-24' author: Rico Valdez, Mauricio Velazco, Splunk status: production @@ -21,7 +21,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process_id) process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="* -ex*" AND Processes.process="* - bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` + bypass *") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index eb1e0f4e3a..5cad885d3f 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -1,6 +1,6 @@ name: Malicious PowerShell Process With Obfuscation Techniques id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 -version: 10 +version: 11 date: '2025-02-10' author: David Dorsey, Splunk status: production @@ -15,15 +15,18 @@ description: The following analytic detects PowerShell processes launched with c security risk. data_source: - Sysmon EventID 1 -search: "| tstats `security_content_summariesonly` count values(Processes.process) +search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` - by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name - Processes.dest Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,\"\ - `\"))-1) + (mvcount(split(process, \"^\"))-1) + (mvcount(split(process, \"'\"))-1) - | `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation - > 10" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, + "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` + | search num_obfuscation > 10' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index eba3aaecd3..adefaf11fd 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -9,12 +9,12 @@ data_source: - MS Defender ATP Alerts description: The following analytic is to leverage alerts from Microsoft Defender ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender ATP Alerts, providing details such as the source, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk obejct, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a dynamic mapping to set the risk score in Enterprise Security based on the severity of the alert. search: ' `ms_defender_atp_alerts` (dest=* OR user=*)| eval tmp_evidence=json_extract(_raw, "evidence"), tmp_evidencemv=json_array_to_mv(tmp_evidence), entityType = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "entityType")), filePath = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "filePath")), processCommandLine = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "processCommandLine")), ipAddress = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "ipAddress")), registryKey = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "registryKey")), url = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "url")), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) -| eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, "entityType") = "File"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) -| eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50 , true(), 2) -| eval processCommandLine=if(processCommandLine="null", "", processCommandLine), ipAddress=if(ipAddress="null", "", ipAddress), registryKey=if(registryKey="null", "", registryKey), url=if(url="null", "", url) -| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description src -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` | `microsoft_defender_atp_alerts_filter`' + | eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, "entityType") = "File"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) + | eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50 , true(), 2) + | eval processCommandLine=if(processCommandLine="null", "", processCommandLine), ipAddress=if(ipAddress="null", "", ipAddress), registryKey=if(registryKey="null", "", registryKey), url=if(url="null", "", url) + | stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description src + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `microsoft_defender_atp_alerts_filter`' how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype. known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index 4cae1ede0f..9756849223 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -9,18 +9,18 @@ data_source: - MS365 Defender Incident Alerts description: The following analytic is to leverage alerts from Microsoft Defender O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender O365 Incidents, providing details such as the destination, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk obejct, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a static mapping to set the risk score based on the severity of the alert. search: '`ms365_defender_incident_alerts` (dest=* OR user=*) -| eval tmp_entities=json_extract(_raw, "entities"), -tmp_entitymv=json_array_to_mv(tmp_entities), -tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, "verdict") != "Clean"), -entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "entityType")), -filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "filePath")), -processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "processCommandLine")), -ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "ipAddress")), -registryKey = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "registryKey")), -url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "url")) -| eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "fileName")) -| eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50, true(), 2) -| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`' + | eval tmp_entities=json_extract(_raw, "entities"), + tmp_entitymv=json_array_to_mv(tmp_entities), + tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, "verdict") != "Clean"), + entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "entityType")), + filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "filePath")), + processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "processCommandLine")), + ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "ipAddress")), + registryKey = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "registryKey")), + url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "url")) + | eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "fileName")) + | eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50, true(), 2) + | stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`' how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype. known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index 5757d7a98d..22e7cc700b 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -1,6 +1,6 @@ name: Mimikatz PassTheTicket CommandLine Parameters id: 13bbd574-83ac-11ec-99d4-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets - /export*" OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`' + /export*" OR Processes.process = "*kerberos::ptt*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `mimikatz_passtheticket_commandline_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml index a2db5e0210..14fff15957 100644 --- a/detections/endpoint/mmc_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_lolbas_execution_process_spawn.yml @@ -1,6 +1,6 @@ name: Mmc LOLBAS Execution Process Spawn id: f6601940-4c74-11ec-b9b7-3e22fbd008af -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -29,10 +29,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", - "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`' + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `mmc_lolbas_execution_process_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index fcb014d2a1..41c25f388b 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -1,7 +1,7 @@ name: Modification Of Wallpaper id: accb0712-c381-11eb-8e5b-acde48001122 -version: '5' -date: '2025-03-03' +version: 6 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,9 +20,10 @@ search: '`sysmon` EventCode =13 (TargetObject IN ("*\\Control Panel\\Desktop\\W Panel\\Desktop\\WallpaperStyle") AND Image != "*\\explorer.exe") OR (TargetObject IN ("*\\Control Panel\\Desktop\\Wallpaper","*\\Control Panel\\Desktop\\WallpaperStyle") AND Details IN ("*\\temp\\*", "*\\users\\public\\*")) | stats count min(_time) as - firstTime max(_time) as lastTime by EventCode Image TargetObject Details Computer - process_guid process_id user_id | rename Computer as dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `modification_of_wallpaper_filter`' + firstTime max(_time) as lastTime by action dest process_guid process_id registry_hive + registry_path registry_key_name registry_value_data registry_value_name status user_id + vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `modification_of_wallpaper_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 247e54e6b3..92dd79d8ec 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -1,6 +1,6 @@ name: Modify ACL permission To Files Or Folder id: 7e8458cc-acca-11eb-9e3f-acde48001122 -version: 6 +version: 7 date: '2024-12-16' author: Teoderick Contreras, Splunk status: production @@ -22,9 +22,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe") AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*" OR Processes.process - = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.parent_process_name - Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' + = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `modify_acl_permission_to_files_or_folder_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 45b3c5e70d..be45e53c57 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -1,6 +1,6 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production @@ -16,10 +16,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND - Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") BY Registry.dest - Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' + Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index eb406c8ba5..aaf14e117a 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -1,6 +1,6 @@ name: MS Scripting Process Loading Ldap Module id: 0b0c40dc-14a6-11ec-b267-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,11 @@ description: The following analytic detects the execution of MS scripting proces data_source: - Sysmon EventID 7 search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded - IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime - max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid - Computer ImageLoaded | rename Computer as dest | `security_content_ctime(firstTime)` + IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file + loaded_file_path original_file_name process_exec process_guid process_hash process_id + process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -63,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index bfe6fe971f..40670f9ec0 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -1,6 +1,6 @@ name: MS Scripting Process Loading WMI Module id: 2eba3d36-14a6-11ec-a682-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ data_source: - Sysmon EventID 7 search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , - "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time) - as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer - ImageLoaded | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `ms_scripting_process_loading_wmi_module_filter`' + "*\\wmiutils.dll", "*\\wbemcomn.dll") | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_wmi_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -65,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index 2163163ec3..ffb57c39af 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -1,6 +1,6 @@ name: MSBuild Suspicious Spawned By Script Process id: 213b3148-24ea-11ec-93a2-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,14 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.dest Processes.parent_process - Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`' + IN ("wscript.exe", "cscript.exe") AND `process_msbuild` by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `msbuild_suspicious_spawned_by_script_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 15849b0340..449ec9d965 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -1,6 +1,6 @@ name: Mshta spawning Rundll32 OR Regsvr32 Process id: 4aa5d062-e893-11eb-9eb2-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - = "mshta.exe" `process_rundll32` OR `process_regsvr32` by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`' + = "mshta.exe" `process_rundll32` OR `process_regsvr32` by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `mshta_spawning_rundll32_or_regsvr32_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index 2c944989d3..cab03bb644 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -1,6 +1,6 @@ name: MSI Module Loaded by Non-System Binary id: ccb98a66-5851-11ec-b91c-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,8 +15,10 @@ description: The following analytic detects the loading of `msi.dll` by a binary data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", - "*\\winsxs\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by - Image ImageLoaded process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` + "*\\winsxs\\*")) | fillnull | stats count min(_time) as firstTime max(_time) as + lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msi_module_loaded_by_non_system_binary_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -45,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 70f151f1ee..3b8dd38765 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -1,6 +1,6 @@ name: Msmpeng Application DLL Side Loading id: 8bb3f280-dd9b-11eb-84d5-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk, Sanjay Govind status: production @@ -13,16 +13,16 @@ description: The following analytic detects the suspicious creation of msmpeng.e malicious, this could lead to ransomware deployment, resulting in data encryption, system compromise, and potential data loss or extortion. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- Sysmon EventID 11 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND NOT (Filesystem.file_path IN ("*\\Program Files\\windows defender\\*","*\\WinSxS\\*defender-service*","*\\WinSxS\\Temp\\*defender-service*")) - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index e34dcb520d..0afede05f4 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -1,6 +1,6 @@ name: NET Profiler UAC bypass id: 0252ca80-e30d-11eb-8aa3-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" - Registry.registry_value_data = "*.dll" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`' + Registry.registry_value_data = "*.dll" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml index 0d917ab5f9..fc92ddd34b 100644 --- a/detections/endpoint/network_connection_discovery_with_arp.yml +++ b/detections/endpoint/network_connection_discovery_with_arp.yml @@ -1,6 +1,6 @@ name: Network Connection Discovery With Arp id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="arp.exe") - (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `network_connection_discovery_with_arp_filter`' + (Processes.process=*-a*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_arp_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -56,7 +59,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/network_connection_discovery_with_netstat.yml b/detections/endpoint/network_connection_discovery_with_netstat.yml index 1422b94323..637cc4d850 100644 --- a/detections/endpoint/network_connection_discovery_with_netstat.yml +++ b/detections/endpoint/network_connection_discovery_with_netstat.yml @@ -1,6 +1,6 @@ name: Network Connection Discovery With Netstat id: 2cf5cc25-f39a-436d-a790-4857e5995ede -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="netstat.exe") - (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `network_connection_discovery_with_netstat_filter`' + (Processes.process=*-a*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_netstat_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -56,7 +59,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index acea9bdc52..f989eebc23 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -1,6 +1,6 @@ name: Network Discovery Using Route Windows App id: dd83407e-439f-11ec-ab8e-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest - Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `network_discovery_using_route_windows_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -54,7 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml index 96fc75806e..a5e2126587 100644 --- a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml +++ b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml @@ -1,6 +1,6 @@ name: Network Traffic to Active Directory Web Services Protocol id: 68a0056c-34cb-455f-b03d-df935ea62c4f -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,9 +15,11 @@ description: The following analytic identifies network traffic directed to the A an attacker could manipulate Active Directory, potentially leading to privilege escalation, unauthorized access, or persistent control over the environment. search: '| tstats count from datamodel=Network_Traffic where All_Traffic.dest_port=9389 - by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.app, All_Traffic.user, All_Traffic.dest_port - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` - | `network_traffic_to_active_directory_web_services_protocol_filter`' + by All_Traffic.action All_Traffic.app All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version + All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `drop_dm_object_name("All_Traffic")` | `network_traffic_to_active_directory_web_services_protocol_filter`' how_to_implement: The detection is based on data that originates from network traffic logs. The logs must contain the source and destination IP addresses, the application name, and the destination port. The logs must be processed using the appropriate @@ -50,7 +52,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index 676364635a..f3b01ad08a 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -1,6 +1,6 @@ name: Nishang PowershellTCPOneLine id: 1a382c6c-7c2e-11eb-ac69-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*Net.Sockets.TCPClient* - AND Processes.process=*System.Text.ASCIIEncoding*) by Processes.dest Processes.user - Processes.parent_process Processes.original_file_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`' + AND Processes.process=*System.Text.ASCIIEncoding*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `nishang_powershelltcponeline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index d62704a59b..1507bc0182 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -1,6 +1,6 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2024-12-16' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_nltest` (Processes.process=*/domain_trusts* - OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `nltest_domain_trust_discovery_filter`' + OR Processes.process=*/all_trusts*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml index 9598488359..50b50cb516 100644 --- a/detections/endpoint/notepad_with_no_command_line_arguments.yml +++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Notepad with no Command Line Arguments id: 5adbc5f1-9a2f-41c1-a810-f37e015f8179 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk type: TTP @@ -19,11 +19,14 @@ description: The following analytic identifies instances where Notepad.exe is la leading to system compromise and unauthorized access. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe - AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(?i)(notepad\.exe.{0,4}$)" - | `notepad_with_no_command_line_arguments_filter`' + AND Processes.action!="blocked" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex + process="(?i)(notepad\.exe.{0,4}$)" | `notepad_with_no_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 6272375790..be3661397e 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -1,6 +1,6 @@ name: Ntdsutil Export NTDS id: da63bc76-61ae-11eb-ae93-0242ac130002 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Patrick Bareiss, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe - Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`' + Processes.process=*ntds* Processes.process=*create*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `ntdsutil_export_ntds_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 6d61ce22e9..cfca818b75 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -1,30 +1,53 @@ name: Outbound Network Connection from Java Using Default Ports id: d2c14d28-5c47-11ec-9892-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Lou Stella, Splunk status: production type: TTP -description: The following analytic detects outbound network connections from Java - processes to default ports used by LDAP and RMI protocols, which may indicate exploitation - of the CVE-2021-44228-Log4j vulnerability. This detection leverages data from Endpoint - Detection and Response (EDR) agents, focusing on process and network traffic logs. - Monitoring this activity is crucial as it can signify an attacker’s attempt to perform - JNDI lookups and retrieve malicious payloads. If confirmed malicious, this activity - could lead to remote code execution and further compromise of the affected server. +description: "The following analytic detects outbound network connections from Java\ + \ processes to default ports used by LDAP and RMI protocols, which may indicate\ + \ exploitation of the CVE-2021-44228-Log4j vulnerability. This detection leverages\ + \ data from Endpoint Detection and Response (EDR) agents, focusing on process and\ + \ network traffic logs. Monitoring this activity is crucial as it can signify an\ + \ attacker\u2019s attempt to perform JNDI lookups and retrieve malicious payloads.\ + \ If confirmed malicious, this activity could lead to remote code execution and\ + \ further compromise of the affected server." data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR - Processes.process_name=javaw.exe) by _time Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic - where (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port - = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.process_id All_Traffic.dest - All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as connection_to_CNC] - | table _time dest parent_process_name process_name process_path process connection_to_CNC - dest_port| `outbound_network_connection_from_java_using_default_ports_filter`' + Processes.process_name=javaw.exe) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where + (All_Traffic.dest_port= 389 OR All_Traffic.dest_port= 636 OR All_Traffic.dest_port + = 1389 OR All_Traffic.dest_port = 1099 ) by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +101,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index a81a27d1ef..1b79e8350a 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -1,6 +1,6 @@ name: Overwriting Accessibility Binaries id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae -version: 8 +version: 9 date: '2025-02-10' author: David Dorsey, Splunk status: production @@ -21,8 +21,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) - by Filesystem.file_name Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index cb60ecf027..72777577dd 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -1,6 +1,6 @@ name: Permission Modification using Takeown App id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -version: 5 +version: 6 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "takeown.exe" - Processes.process = "*/f*" by Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id - Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`' + Processes.process = "*/f*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index f806c2c4b8..1c7af51e61 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -1,6 +1,6 @@ name: Ping Sleep Batch Command id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 7 +version: 8 date: '2025-02-19' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*>*") OR (Processes.process = "*ping*" Processes.process = *-n* Processes.process="* Nul*"Processes.process="*>*") - by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.process_guid - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `ping_sleep_batch_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/ping_sleep/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 65339f563a..ea362d0785 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -1,6 +1,6 @@ name: Possible Browser Pass View Parameter id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -23,10 +23,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" ) AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `possible_browser_pass_view_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -54,7 +57,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 0829ca7479..d806def4f4 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -1,6 +1,6 @@ name: Possible Lateral Movement PowerShell Spawn id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 9 +version: 10 date: '2025-02-10' author: Mauricio Velazco, Michael Haag, Splunk status: production @@ -23,10 +23,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe) (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*) OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*)) - NOT (Processes.process IN ("*c:\\windows\\ccm\\*")) by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`' + NOT (Processes.process IN ("*c:\\windows\\ccm\\*")) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `possible_lateral_movement_powershell_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -91,7 +95,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml index 7939bcde78..78d008a2ef 100644 --- a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -1,18 +1,47 @@ name: Potential System Network Configuration Discovery Activity id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5 -version: 2 +version: 3 date: '2025-01-20' author: Bhavin Patel, Splunk status: production type: Anomaly -description: The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity can be significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise. +description: The following analytic identifies the rapid execution of processes used + for system network configuration discovery on an endpoint. It leverages data from + Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, + parent processes, and command-line executions. This activity can be significant + as it may indicate an attacker attempting to map the network, which is a common + precursor to lateral movement or further exploitation. If confirmed malicious, this + behavior could allow an attacker to gain insights into the network topology, identify + critical systems, and plan subsequent attacks, potentially leading to data exfiltration + or system compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.parent_process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process parent_process_name eventcount | `potential_system_network_configuration_discovery_activity_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + as process values(Processes.parent_process) as parent_process min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user + IN ("","unknown") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product _time | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search + `system_network_configuration_discovery_tools` | transaction dest connected=false + maxpause=5m | where eventcount>=5 | `potential_system_network_configuration_discovery_activity_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: It is uncommon for normal users to execute a series of commands + used for network discovery. System administrators often use scripts to execute these + commands. These can generate false positives. references: [] drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" @@ -20,7 +49,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/potential_telegram_api_request_via_commandline.yml b/detections/endpoint/potential_telegram_api_request_via_commandline.yml index 6e704fe58a..0d6b406512 100644 --- a/detections/endpoint/potential_telegram_api_request_via_commandline.yml +++ b/detections/endpoint/potential_telegram_api_request_via_commandline.yml @@ -1,18 +1,43 @@ name: Potential Telegram API Request Via CommandLine id: d6b0d627-d0bf-46b1-936f-c48284767d21 -version: 1 +version: 2 date: '2025-02-19' author: Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa status: production type: Anomaly -description: The following analytic detects the presence of "api.telegram.org" in the CommandLine of a process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity can be significant as the telegram API has been used as an exfiltration mechanism or even as a C2 channel. If confirmed malicious, this could allow an attacker or malware to exfiltrate data or receive additional C2 instruction, potentially leading to further compromise and persistence within the network. +description: The following analytic detects the presence of "api.telegram.org" in + the CommandLine of a process. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process execution logs that include command-line details. + This activity can be significant as the telegram API has been used as an exfiltration + mechanism or even as a C2 channel. If confirmed malicious, this could allow an attacker + or malware to exfiltrate data or receive additional C2 instruction, potentially + leading to further compromise and persistence within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process= "*api.telegram.org*" NOT Processes.process IN ("*-osint -url*", "* --single-argument*") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `potential_telegram_api_request_via_commandline_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positive may stem from application or users requesting the API directly via CommandLine for testing purposes. Investigate the matches and apply the necessary filters. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process= "*api.telegram.org*" + NOT Processes.process IN ("*-osint -url*", "* --single-argument*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `potential_telegram_api_request_via_commandline_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positive may stem from application or users requesting + the API directly via CommandLine for testing purposes. Investigate the matches and + apply the necessary filters. references: - https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior - https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior @@ -56,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index d436c3465a..554e460501 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -1,6 +1,6 @@ name: Potentially malicious code on commandline id: 9c53c446-757e-11ec-871d-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Michael Hart, Splunk status: production @@ -18,14 +18,22 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=\"Endpoint.Processes\" by Processes.parent_process_name - Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)`\ - \ | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` - | apply unusual_commandline_detection | eval score='predicted(unusual_cmdline_logits)', +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.original_file_name) as original_file_name values(Processes.action) + as action values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) + as parent_process_guid values(Processes.parent_process_id) as parent_process_id + values(Processes.parent_process_path) as parent_process_path values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) + as process_path values(Processes.user) as user values(Processes.user_id) as user_id + values(Processes.vendor_product) as vendor_product from datamodel="Endpoint.Processes" + by Processes.parent_process_name Processes.process_name Processes.process Processes.user + Processes.dest | `drop_dm_object_name(Processes)` | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` + | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'', process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `potentially_malicious_code_on_commandline_filter`" + | `potentially_malicious_code_on_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/malicious_cmd_line_samples/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/malicious_cmd_line_samples/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index d03afb46b9..8f40c9639d 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,6 +1,6 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: '13' +version: '14' date: '2025-02-28' author: Michael Haag, Splunk status: production @@ -73,6 +73,7 @@ tags: - Data Destruction - Hermetic Wiper - SystemBC + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index d69d9be400..cc90b20183 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -1,6 +1,6 @@ name: PowerShell - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 12 +version: 13 date: '2025-02-10' author: David Dorsey, Michael Haag Splunk status: production @@ -18,12 +18,16 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user - Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name - Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/|– |—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") - | `powershell___connect_to_internet_with_hidden_window_filter`' +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ + \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.action\ + \ Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec\ + \ Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name\ + \ Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid\ + \ Processes.process_hash Processes.process_id Processes.process_integrity_level\ + \ Processes.process_name Processes.process_path Processes.user Processes.user_id\ + \ Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ + \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ + \ |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`" how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -63,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml index 2999af89df..5a5d90d30a 100644 --- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml @@ -1,6 +1,6 @@ name: Powershell COM Hijacking InprocServer32 Modification id: ea61e291-af05-4716-932a-67faddb6ae6f -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects attempts to modify or add a Componen data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*Software\\Classes\\CLSID\\*\\InProcServer32*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_com_hijacking_inprocserver32_modification_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the PowerShell macro as needed to match the sourcetype or add index. @@ -45,9 +46,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A PowerShell script has been identified with InProcServer32 within the - script code on $Computer$. + script code on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 64 threat_objects: [] @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 17dc9e26a6..7525e4cb2e 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -1,6 +1,6 @@ name: Powershell Creating Thread Mutex id: 637557ec-ca08-11eb-bd0a-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of PowerShell scripts within the environment. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest |rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -31,13 +31,13 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -50,7 +50,7 @@ rba: - field: dest type: system score: 40 - - field: user + - field: user_id type: user score: 40 threat_objects: [] @@ -69,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 1564ed0507..0370522a12 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -1,6 +1,6 @@ name: Powershell Disable Security Monitoring id: c148a894-dd93-11eb-bf2a-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,8 +20,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*DisableScanningNetworkFiles*","*DisableScanningMappedNetworkDrivesForFullScan*","*DisableRemovableDriveScanning*","*DisableArchiveScanning*","*DisableCatchupFullScan*","*DisableCatchupQuickScan*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*MAPSReporting*","*drdsc *","*dsnf *","*drtm *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *","*dips *") by - Processes.dest Processes.user Processes.parent_process Processes.original_file_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index b5d57545c4..b48ee66e5d 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -1,6 +1,6 @@ name: PowerShell Domain Enumeration id: e1866ce2-ca22-11eb-8e44-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the execution of PowerShell commands data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*, - *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time) - as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText UserID - | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`' + *get-addomain*, *get-adgroupmember*, *get-domainuser*) | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id + vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -31,13 +31,13 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -46,12 +46,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ - with EventCode $EventCode$ in host $dest$ + in host $dest$ risk_objects: - field: dest type: system score: 42 - - field: user + - field: user_id type: user score: 42 threat_objects: [] @@ -72,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_enable_powershell_remoting.yml b/detections/endpoint/powershell_enable_powershell_remoting.yml index 412a67fcd6..0ec68cb2db 100644 --- a/detections/endpoint/powershell_enable_powershell_remoting.yml +++ b/detections/endpoint/powershell_enable_powershell_remoting.yml @@ -1,6 +1,6 @@ name: PowerShell Enable PowerShell Remoting id: 40e3b299-19a5-4460-96e9-e1467f714f8e -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk type: Anomaly @@ -15,8 +15,9 @@ description: The following analytic detects the use of the Enable-PSRemoting cmd this activity could allow an attacker to take control of the system remotely, execute commands, and potentially pivot to other systems within the network, leading to further compromise and lateral movement. -search: '`powershell` EventCode=4104 ScriptBlockText="*Enable-PSRemoting*" | stats - count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText +search: '`powershell` EventCode=4104 ScriptBlockText="*Enable-PSRemoting*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `powershell_enable_powershell_remoting_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -41,9 +42,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: PowerShell was identified running a Invoke-PSremoting on $Computer$. + message: PowerShell was identified running a Invoke-PSremoting on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 25 threat_objects: [] @@ -61,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 4027bd9cbf..ea353777dc 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -1,6 +1,6 @@ name: Powershell Enable SMB1Protocol Feature id: afed80b2-d34b-11eb-a952-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,8 +15,9 @@ description: The following analytic detects the enabling of the SMB1 protocol vi data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" - ScriptBlockText = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` + ScriptBlockText = "*SMB1Protocol*" | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed @@ -40,9 +41,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Powershell Enable SMB1Protocol Feature on $Computer$ + message: Powershell Enable SMB1Protocol Feature on $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 25 threat_objects: [] @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 0829d8c7a5..598976ff70 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -1,6 +1,6 @@ name: Powershell Execute COM Object id: 65711630-f9bf-11eb-8d72-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the execution of a COM CLSID through data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_execute_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -65,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index be8d0a5b04..bb1d4edc93 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -1,6 +1,6 @@ name: Powershell Fileless Process Injection via GetProcAddress id: a26d9db4-c883-11eb-9d75-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the use of `GetProcAddress` in Power review parallel processes and the entire logged script block for further investigation. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText=*getprocaddress* | stats count - min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText=*getprocaddress* | fillnull | + stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index c6cf407c05..8d1616c66c 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,6 +1,6 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of PowerShell scripts detect. If confirmed malicious, this could lead to code execution, allowing attackers to run arbitrary commands and potentially compromise the system. search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText - = "*gnirtS46esaBmorF*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer UserID | rename Computer as dest |rename UserID - as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_fileless_script_contains_base64_encoded_content_filter`' + = "*gnirtS46esaBmorF*" | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -71,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 95170cb2f8..7e642a7809 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -1,6 +1,6 @@ name: PowerShell Get LocalGroup Discovery id: b71adfcc-155b-11ec-9413-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe - OR Processes.process_name=cmd.exe) (Processes.process="*get-localgroup*") by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_filter`' + OR Processes.process_name=cmd.exe) (Processes.process="*get-localgroup*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `powershell_get_localgroup_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 633fbc71a1..09df1147d8 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -1,6 +1,6 @@ name: Powershell Get LocalGroup Discovery with Script Block Logging id: d7c6ad22-155c-11ec-bb64-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the PowerShell cmdl Review parallel processes and the entire script block for comprehensive analysis. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats - count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -44,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml index 3d21b2281b..78bcb66712 100644 --- a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml +++ b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml @@ -1,6 +1,6 @@ name: PowerShell Invoke CIMMethod CIMSession id: 651ee958-a433-471c-b264-39725b788b83 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk type: Anomaly @@ -15,8 +15,9 @@ description: The following analytic detects the creation of a New-CIMSession cmd If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access and control over targeted systems. search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-CIMMethod*", "*New-CimSession*") - | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode - ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_invoke_cimmethod_cimsession_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -42,9 +43,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: PowerShell was identified running a Invoke-CIMMethod Invoke-CIMSession - on $Computer$. + on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 25 threat_objects: [] @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_invoke_wmiexec_usage.yml b/detections/endpoint/powershell_invoke_wmiexec_usage.yml index 054bf73300..35a9141570 100644 --- a/detections/endpoint/powershell_invoke_wmiexec_usage.yml +++ b/detections/endpoint/powershell_invoke_wmiexec_usage.yml @@ -1,6 +1,6 @@ name: PowerShell Invoke WmiExec Usage id: 0734bd21-2769-4972-a5f1-78bb1e011224 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk type: TTP @@ -14,8 +14,9 @@ description: The following analytic detects the execution of the Invoke-WMIExec using WMI commands with NTLMv2 pass-the-hash authentication. If confirmed malicious, this activity could allow an attacker to execute commands remotely on target systems, potentially leading to further compromise and lateral spread within the network. -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-wmiexec*") | stats - count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-wmiexec*") | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_invoke_wmiexec_usage_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -40,9 +41,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: PowerShell was identified running a Invoke-WmiExec on $Computer$. + message: PowerShell was identified running a Invoke-WmiExec on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 100 threat_objects: [] @@ -60,7 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_load_module_in_meterpreter.yml b/detections/endpoint/powershell_load_module_in_meterpreter.yml index 48f13d3839..de997dba6b 100644 --- a/detections/endpoint/powershell_load_module_in_meterpreter.yml +++ b/detections/endpoint/powershell_load_module_in_meterpreter.yml @@ -1,6 +1,6 @@ name: Powershell Load Module in Meterpreter id: d5905da5-d050-48db-9259-018d8f034fcf -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the execution of suspicious PowerShe data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*MSF.Powershell*","*MSF.Powershell.Meterpreter*","*MSF.Powershell.Meterpreter.Kiwi*","*MSF.Powershell.Meterpreter.Transport*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_load_module_in_meterpreter_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. @@ -43,12 +44,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: PowerShell was identified running a script utilized by Meterpreter from - MetaSploit on endpoint $Computer$ by user $user_id$. + MetaSploit on endpoint $dest$ by user $user_id$. risk_objects: - field: user_id type: user score: 100 - - field: Computer + - field: dest type: system score: 100 threat_objects: [] @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/metasploit/msf.powershell.powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/metasploit/msf.powershell.powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index d7d526e11e..547fb3ab23 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,6 +1,6 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -17,10 +17,10 @@ description: The following analytic detects the use of PowerShell scripts to loa persistent access within the environment. search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*", "*Reflection.Assembly.Load*", "*UnsafeLoadFrom*", "*.LoadFrom(*", "*.LoadModule(*", - "*.LoadWithPartialName*", "*ReflectionOnlyLoad*") | stats count min(_time) as firstTime - max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | rename - Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_loading_dotnet_into_memory_via_reflection_filter`' + "*.LoadWithPartialName*", "*ReflectionOnlyLoad*") | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product + EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -33,13 +33,13 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -48,13 +48,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A suspicious powershell script contains reflective class assembly command - in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in - host $dest$ + in $ScriptBlockText$ to load .net code in memory in host $dest$ risk_objects: - field: dest type: system score: 56 - - field: user + - field: user_id type: user score: 56 threat_objects: [] @@ -77,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 76d78cf424..a8573b6ca4 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,6 +1,6 @@ name: Powershell Processing Stream Of Data id: 0d718b52-c9f1-11eb-bc61-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects suspicious PowerShell script executi data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText - = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID - | rename UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_processing_stream_of_data_filter`' + = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*" | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -48,12 +48,12 @@ drilldown_searches: rba: message: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode - $EventCode$ in host $Computer$ + $EventID$ in host $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 40 - - field: user + - field: user_id type: user score: 40 threat_objects: [] @@ -78,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_remote_services_add_trustedhost.yml b/detections/endpoint/powershell_remote_services_add_trustedhost.yml index 7a96343fb7..14d0a34dc0 100644 --- a/detections/endpoint/powershell_remote_services_add_trustedhost.yml +++ b/detections/endpoint/powershell_remote_services_add_trustedhost.yml @@ -1,6 +1,6 @@ name: Powershell Remote Services Add TrustedHost id: bef21d24-297e-45e3-9b9a-c6ac45450474 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the execution of a PowerShell script to establish persistent remote connections, bypass security protocols, and gain unauthorized access to sensitive systems and data. search: '`powershell` EventCode=4104 ScriptBlockText = "*WSMan:\\localhost\\Client\\TrustedHosts*" - ScriptBlockText IN ("* -Value *", "* -Concatenate *") | rename Computer as dest, - UserID as user | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_remote_services_add_trustedhost_filter`' + ScriptBlockText IN ("* -Value *", "* -Concatenate *") | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product + EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_remote_services_add_trustedhost_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -28,13 +28,13 @@ known_false_positives: user and network administrator may used this function to references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -47,7 +47,7 @@ rba: - field: dest type: system score: 64 - - field: user + - field: user_id type: user score: 64 threat_objects: [] @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/wsman_trustedhost/wsman_pwh.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/wsman_trustedhost/wsman_pwh.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index b342e7fea3..d41f5d4154 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -1,6 +1,6 @@ name: Powershell Remote Thread To Known Windows Process id: ec102cb2-a0f5-11eb-9b38-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,12 @@ data_source: - Sysmon EventID 8 search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") - | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name - SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress - dest EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId + ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress + StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest + parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path + process_exec process_guid process_id process_name process_path signature signature_id + user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are @@ -44,7 +47,7 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A suspicious powershell process $process_name$ that tries to create a remote - thread on target process $TargetImage$ with eventcode $EventCode$ in host $dest$ + thread on target process $TargetImage$ on host $dest$ risk_objects: - field: dest type: system @@ -66,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 8b6f9c3a6d..970833a272 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -1,6 +1,6 @@ name: Powershell Remove Windows Defender Directory id: adf47620-79fa-11ec-b248-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects a suspicious PowerShell command atte data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText - = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) - as lastTime by Opcode Computer UserID EventCode ScriptBlockText | rename UserID - as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_remove_windows_defender_directory_filter`' + = "*\\Microsoft\\Windows Defender*" | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -40,12 +40,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: suspicious powershell script $ScriptBlockText$ was executed on the $Computer$ + message: suspicious powershell script $ScriptBlockText$ was executed on the $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 90 - - field: user + - field: user_id type: user score: 90 threat_objects: [] @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_script_block_with_url_chain.yml index 12c23a7a46..2621147270 100644 --- a/detections/endpoint/powershell_script_block_with_url_chain.yml +++ b/detections/endpoint/powershell_script_block_with_url_chain.yml @@ -1,6 +1,6 @@ name: PowerShell Script Block With URL Chain id: 4a3f2a7d-6402-4e64-a76a-869588ec3b57 -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production @@ -18,11 +18,10 @@ data_source: search: '`powershell` EventCode=4104 ScriptBlockText IN ("*http:*","*https:*") | regex ScriptBlockText="(\"?(https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))\"?(?:,|\))?){2,}" | rex max_match=20 field=ScriptBlockText "(?https?:\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*))" - | eval Path = case(isnotnull(Path),Path,true(),"unknown") | stats count min(_time) - as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Path) - as file_name values(UserID) as user values(url) as url dc(url) as url_count by ActivityID, - Computer, EventCode | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_script_block_with_url_chain_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `powershell_script_block_with_url_chain_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -46,20 +45,16 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A suspicious powershell script used by $user$ on host $dest$ contains $url_count$ + message: A suspicious powershell script used by $user_id$ on host $dest$ contains URLs in an array, this is commonly used for malware. risk_objects: - field: dest type: system score: 80 - - field: user + - field: user_id type: user score: 80 - threat_objects: - - field: file_name - type: file_name - - field: url - type: url + threat_objects: [] tags: analytic_story: - Malicious PowerShell @@ -75,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 6b50ec5b4f..0fddbd5186 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -1,6 +1,6 @@ name: PowerShell Start-BitsTransfer id: 39e2605a-90d8-11eb-899e-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*start-bitstransfer* - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_start_bitstransfer_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index 4779e1c10c..b9a189f016 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -1,6 +1,6 @@ name: PowerShell Start or Stop Service id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk type: Anomaly @@ -15,16 +15,17 @@ description: The following analytic identifies the use of PowerShell's Start-Ser to disable security services, evade detection, or disrupt essential services, leading to potential system downtime and compromised security. search: '`powershell` EventCode=4104 ScriptBlockText IN ("*start-service*", "*stop-service*") - | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode - ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_start_or_stop_service_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: This behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. Therefore, - it is recommended not to enable this analytic as a direct finding Instead, - it should be used as part of a broader set of security controls to detect and investigate + it is recommended not to enable this analytic as a direct finding Instead, it should + be used as part of a broader set of security controls to detect and investigate potential threats. references: - https://learn-powershell.net/2012/01/15/startingstopping-and-restarting-remote-services-with-powershell/ @@ -44,9 +45,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: PowerShell was identified attempting to start or stop a service on $Computer$. + message: PowerShell was identified attempting to start or stop a service on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 10 threat_objects: [] @@ -64,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index e33e455cd2..30a8c64e32 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -1,6 +1,6 @@ name: Powershell Using memory As Backing Store id: c396a0c4-c9f2-11eb-b4f5-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects suspicious PowerShell script executi data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = *New-Object* ScriptBlockText - = *IO.MemoryStream* | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer UserID | rename Computer as dest | rename - UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_using_memory_as_backing_store_filter`' + = *IO.MemoryStream* | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_using_memory_as_backing_store_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -33,13 +33,13 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -52,7 +52,7 @@ rba: - field: dest type: system score: 40 - - field: user + - field: user_id type: user score: 40 threat_objects: [] @@ -74,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 2c0fa1ba0d..7bdc4042ec 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -1,6 +1,6 @@ name: PowerShell WebRequest Using Memory Stream id: 103affa6-924a-4b53-aff4-1d5075342aab -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production @@ -16,10 +16,9 @@ description: The following analytic detects the use of .NET classes in PowerShel data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*system.net.webclient*","*system.net.webrequest*") - AND ScriptBlockText="*IO.MemoryStream*" | eval Path = case(isnotnull(Path),Path,true(),"unknown") - | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) - as command values(Path) as file_name values(UserID) as user by ActivityID, Computer, - EventCode | rename Computer as dest, EventCode as signature_id | `security_content_ctime(firstTime)` + AND ScriptBlockText="*IO.MemoryStream*" | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_webrequest_using_memory_stream_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. @@ -45,21 +44,20 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Powershell webrequest to memory stream behavior. Possible fileless malware - staging on $dest$ by $user$. + staging on $dest$ by $user_id$. risk_objects: - field: dest type: system score: 80 - - field: user + - field: user_id type: user score: 80 - threat_objects: - - field: file_name - type: file_name + threat_objects: [] tags: analytic_story: - Malicious PowerShell - MoonPeak + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint mitre_attack_id: - T1059.001 @@ -73,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 04e6fb422d..d33847597f 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -1,6 +1,6 @@ name: Powershell Windows Defender Exclusion Commands id: 907ac95c-4dd9-11ec-ba2c-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the use of PowerShell commands to ad data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Add-MpPreference *" OR ScriptBlockText - = "*Set-MpPreference *") AND ScriptBlockText = "*-exclusion*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID - | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_windows_defender_exclusion_commands_filter`' + = "*Set-MpPreference *") AND ScriptBlockText = "*-exclusion*" | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_windows_defender_exclusion_commands_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -29,12 +29,12 @@ references: - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -45,7 +45,7 @@ drilldown_searches: rba: message: Exclusion command $ScriptBlockText$ executed on $dest$ risk_objects: - - field: user + - field: user_id type: user score: 64 - field: dest @@ -72,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index 06ea69848f..2635bea612 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -1,6 +1,6 @@ name: Prevent Automatic Repair Mode using Bcdedit id: 7742aa92-c9d9-11eb-bbfc-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" - by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml index 0e909c3988..c545f531cf 100644 --- a/detections/endpoint/print_processor_registry_autostart.yml +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -1,6 +1,6 @@ name: Print Processor Registry Autostart id: 1f5b68aa-2037-11ec-898e-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: experimental @@ -16,9 +16,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.dest Registry.user - Registry.registry_path Registry.registry_key_name Registry.registry_value_name | - `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` + ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `print_processor_registry_autostart_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -58,7 +60,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/1f5b68aa-2037-11ec-898e-acde48001122.txt + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/1f5b68aa-2037-11ec-898e-acde48001122.txt source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 820170d6e4..f1f6ab9ab4 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -1,6 +1,6 @@ name: Process Creating LNK file in Suspicious Location id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 -version: 10 +version: 11 date: '2025-02-10' author: Jose Hernandez, Michael Haag, Splunk status: production @@ -13,19 +13,15 @@ description: The following analytic detects a process creating a `.lnk` file in If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system. data_source: -- Sysmon EventID 11 AND Sysmon EventID 1 +- Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\Users\\*" OR Filesystem.file_path="*\\Temp\\*") by - _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path - Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` | rename - process_guid as lnk_guid | join lnk_guid _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time - span=1h Processes.parent_process_name Processes.parent_process_guid Processes.process_name - Processes.dest Processes.process Processes.path | `drop_dm_object_name(Processes)` - | rename parent_process_guid as lnk_guid] | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | table firstTime, lastTime, lnk_guid, user, - dest, file_name, file_path, process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter`' + Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_creating_lnk_file_in_suspicious_location_filter`' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data @@ -51,8 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A process $process_name$ that launching .lnk file in $file_path$ in host - $dest$ + message: A process launches .lnk file in $file_path$ in host $dest$ risk_objects: - field: dest type: system @@ -79,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index bec4822fbf..c8b0c758f7 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -1,6 +1,6 @@ name: Process Deleting Its Process File Path id: f7eda4bc-871c-11eb-b110-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras status: production @@ -15,13 +15,13 @@ description: The following analytic identifies a process attempting to delete it remediation efforts. data_source: - Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" | eval result = if(like(process,"%".parent_process."%"), "Found", - "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by dest - user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result - | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by action + dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + result | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -52,7 +52,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A process $Image$ tries to delete its process path in commandline $CommandLine$ + message: A process $process_name$ tries to delete its process path in commandline $process$ as part of defense evasion in host $dest$ by user $user$ risk_objects: - field: dest @@ -79,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 2c46069609..da336be457 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -1,6 +1,6 @@ name: Process Execution via WMI id: 24869767-8579-485d-9a4f-d9ddfd8f0cac -version: 8 +version: 9 date: '2024-11-13' author: Rico Valdez, Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe - NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`' + NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `process_execution_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 1ec53796f1..290e6fa2d4 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -1,6 +1,6 @@ name: Process Kill Base On File Path id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` AND Processes.process="*process*" - AND Processes.process="*executablepath*" AND Processes.process="*delete*" by Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.dest Processes.user + AND Processes.process="*executablepath*" AND Processes.process="*delete*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_kill_base_on_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index a76100c545..94ee9d47de 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -1,6 +1,6 @@ name: Process Writing DynamicWrapperX id: b0a078e4-2601-11ec-9aec-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -14,18 +14,13 @@ description: The following analytic detects a process writing the dynwrapx.dll f code, escalate privileges, or maintain persistence within the environment. Immediate investigation of parallel processes and registry modifications is recommended. data_source: -- Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid - Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats - `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where - Filesystem.file_name="dynwrapx.dll" by _time Filesystem.dest Filesystem.file_create_time - Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user - | `drop_dm_object_name(Filesystem)` | fields _time process_guid file_path file_name - file_create_time user dest process_name] | stats count min(_time) as firstTime max(_time) - as lastTime by dest process_name process_guid file_name file_path file_create_time - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `process_writing_dynamicwrapperx_filter`' +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name="dynwrapx.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_writing_dynamicwrapperx_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` @@ -56,7 +51,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index 212cf0f860..b5228dcfb5 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -1,6 +1,6 @@ name: Processes launching netsh id: b89919ed-fe5f-492c-b139-95dbb162040e -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Josef Kuepker, Splunk status: production @@ -17,10 +17,13 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process) - AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_netsh` by Processes.parent_process_name Processes.parent_process - Processes.original_file_name Processes.process_name Processes.user Processes.dest +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_netsh` by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`processes_launching_netsh_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -44,7 +47,7 @@ drilldown_searches: latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 631b0fc764..85787d0b9d 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -1,7 +1,7 @@ name: Ransomware Notes bulk creation id: eff7919a-8330-11eb-83f8-acde48001122 -version: '5' -date: '2025-03-03' +version: 6 +date: '2025-03-27' author: Teoderick Contreras status: production type: Anomaly @@ -14,11 +14,16 @@ description: The following analytic identifies the bulk creation of ransomware n files inaccessible and potentially causing significant operational disruption. data_source: - Sysmon EventID 11 -search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time +search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") | bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) - as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer - Image file_name | rename Computer as dest | where unique_readme_path_count >= 15 - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`' + as unique_readme_path_count values(TargetFilename) as list_of_readme_path values(action) + as action values(file_access_time) as file_access_time values(file_create_time) + as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size values(process_guid) as process_guid values(process_id) as process_id + values(user) as user values(vendor_product) as vendor_product by dest file_name + | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `ransomware_notes_bulk_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index b217c5d2a0..2f0e88c9a0 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -1,6 +1,6 @@ name: Recon AVProduct Through Pwh or WMI id: 28077620-c9f6-11eb-8785-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,10 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*") AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `recon_avproduct_through_pwh_or_wmi_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -32,13 +33,13 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -51,7 +52,7 @@ rba: - field: dest type: system score: 56 - - field: user + - field: user_id type: user score: 56 threat_objects: [] @@ -76,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 45443c4674..ba16fc76ea 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -1,6 +1,6 @@ name: Recon Using WMI Class id: 018c1972-ca07-11eb-9473-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,9 +20,10 @@ search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlock OR ScriptBlockText= "*Win32_Processor*" OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_PnPEntity*" OR ScriptBlockText= "*Win32_ShadowCopy*" OR ScriptBlockText= "*Win32_DiskDrive*" OR ScriptBlockText= "*Win32_PhysicalMemory*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `recon_using_wmi_class_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -37,13 +38,13 @@ references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -57,7 +58,7 @@ rba: - field: dest type: system score: 60 - - field: user + - field: user_id type: user score: 60 threat_objects: [] @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 89aa7cb4e4..2015337a39 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -1,6 +1,6 @@ name: Recursive Delete of Directory In Batch CMD id: ba570b3a-d356-11eb-8358-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process="* - rd *" Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name - Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id - Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`' + rd *" Processes.process="*/s*" Processes.process="*/q*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `recursive_delete_of_directory_in_batch_cmd_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 096acf7bf7..4a64b1a04b 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -1,6 +1,6 @@ name: Reg exe Manipulating Windows Services Registry Keys id: 8470d755-0c13-45b3-bd63-387a373c10cf -version: 10 +version: 11 date: '2025-02-10' author: Rico Valdez, Splunk status: production @@ -21,9 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* - Processes.process=*Services* by Processes.process_id Processes.dest Processes.process - | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `reg_exe_manipulating_windows_services_registry_keys_filter`' + Processes.process=*Services* by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `reg_exe_manipulating_windows_services_registry_keys_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 9487738cc2..4f63116db3 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -1,6 +1,6 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 12 +version: 13 date: '2025-02-10' author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production @@ -17,11 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* - OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) BY Registry.dest - Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `registry_keys_for_creating_shim_databases_filter`' + OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 65ff7b2113..113ece6636 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: '18' -date: '2025-02-28' +version: 19 +date: '2025-03-27' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -37,10 +37,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" - AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`' + AND Registry.registry_key_name="auto_update")) by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -98,6 +100,7 @@ tags: - Ransomware - RedLine Stealer - Remcos + - PHP-CGI RCE Attack on Japanese Organizations - Snake Keylogger - SnappyBee - Sneaky Active Directory Persistence Tricks diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 852eada1f8..8d384b1b5d 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -version: 12 +version: 13 date: '2025-02-10' author: David Dorsey, Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag - OR Registry.registry_value_name=Debugger)) BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`' + OR Registry.registry_value_name=Debugger)) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `registry_keys_used_for_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 89f088a05b..1a66fdb18d 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -1,6 +1,6 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` AND Processes.process="*/i*" - by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where - match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_silent_and_install_param_dll_loading_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | where match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_silent_and_install_param_dll_loading_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 43b74c27f5..2f3f9bba02 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -1,6 +1,6 @@ name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,11 +18,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.user - Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name - Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/][Ss]{1}") - | `regsvr32_with_known_silent_switch_cmdline_filter`' + as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | where match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_with_known_silent_switch_cmdline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 6a33393f9a..1d77d40f68 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,6 +1,6 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk status: production @@ -14,22 +14,15 @@ description: The following analytic detects the presence of a registry key assoc over the system, steal sensitive information, or use the compromised host for further attacks. Immediate investigation and remediation are required. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_key_name=*\\Software\\Remcos*) BY _time span=1h Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`remcos_client_registry_install_entry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + WHERE (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + |`remcos_client_registry_install_entry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 82a0d3c39b..7a7f557604 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -1,6 +1,6 @@ name: Remcos RAT File Creation in Remcos Folder id: 25ae862a-1ac3-11ec-94a1-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk, Sanjay Govind status: production @@ -16,8 +16,10 @@ data_source: - Sysmon EventID 11 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat") - Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path - Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` + Filesystem.file_path = "*\\remcos\\*" by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -62,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_desktop_process_running_on_system.yml b/detections/endpoint/remote_desktop_process_running_on_system.yml index 90532d273c..93c90ca2d7 100644 --- a/detections/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/endpoint/remote_desktop_process_running_on_system.yml @@ -1,6 +1,6 @@ name: Remote Desktop Process Running On System id: f5939373-8054-40ad-8c64-cec478a22a4a -version: 9 +version: 10 date: '2025-02-10' author: David Dorsey, Splunk status: experimental @@ -19,9 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*mstsc.exe - AND Processes.dest_category!=common_rdp_source by Processes.dest Processes.user - Processes.process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | `remote_desktop_process_running_on_system_filter`' + AND Processes.dest_category!=common_rdp_source by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` + | `remote_desktop_process_running_on_system_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index c9b9804885..7d41132bc8 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via DCOM and PowerShell id: d4f42098-4680-11ec-ad07-3e22fbd008af -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,10 +20,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*" - OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`' + OR Processes.process="*Document.Application.ShellExecute*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `remote_process_instantiation_via_dcom_and_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml index 2b3c8abaab..fe73976a20 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via DCOM and PowerShell Script Block id: fa1c3040-4680-11ec-a618-3e22fbd008af -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -15,13 +15,13 @@ description: The following analytic detects the execution of PowerShell commands data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText="*Document.Application.ShellExecute*" - OR ScriptBlockText="*Document.ActiveView.ExecuteShellCommand*") | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + OR ScriptBlockText="*Document.ActiveView.ExecuteShellCommand*") | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions - can be found - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users. references: @@ -42,10 +42,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A process was started on a remote endpoint from $Computer$ by abusing WMI - using PowerShell.exe + message: A process was started on a remote endpoint from $dest$ by abusing WMI using + PowerShell.exe risk_objects: - - field: Computer + - field: dest type: system score: 63 threat_objects: [] @@ -63,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index fc7a0db67d..882dded535 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via WinRM and PowerShell id: ba24cda8-4716-11ec-8009-3e22fbd008af -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*" - AND Processes.process="*-ComputerName*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `remote_process_instantiation_via_winrm_and_powershell_filter`' + AND Processes.process="*-ComputerName*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml index 63c06643c1..834d32b394 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via WinRM and PowerShell Script Block id: 7d4c618e-4716-11ec-951c-3e22fbd008af -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -15,13 +15,13 @@ description: The following analytic detects the execution of PowerShell commands data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND ScriptBlockText="*-ComputerName*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions - can be found - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. This activity is usually limited to a small set of hosts or users. In certain environments, @@ -30,12 +30,12 @@ references: - https://attack.mitre.org/techniques/T1021/006/ - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ drilldown_searches: -- name: View the detection results for - "$Computer$" - search: '%original_detection_search% | search Computer = "$Computer$"' +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -44,10 +44,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A process was started on a remote endpoint from $Computer$ by abusing WinRM + message: A process was started on a remote endpoint from $dest$ by abusing WinRM using PowerShell.exe risk_objects: - - field: Computer + - field: dest type: system score: 45 threat_objects: [] @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index f2d3dcf4d5..3843b4f62b 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via WinRM and Winrs id: 0dd296a2-4338-11ec-ba02-3e22fbd008af -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=winrs.exe OR Processes.original_file_name=winrs.exe) (Processes.process="*-r:*" OR Processes.process="*-remote:*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `remote_process_instantiation_via_winrm_and_winrs_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 677dae13f9..8c6f4613b2 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,8 +1,8 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: '12' -date: '2025-02-24' -author: Rico Valdez, Mauricio Velazco, Splunk +version: '13' +date: '2025-03-27' +author: Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects the execution of wmic.exe with parameters @@ -20,8 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process="*/node:*" AND Processes.process="*process*" AND Processes.process="*call*" AND Processes.process="*create*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index 5ece97d2c9..384c412a26 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WMI and PowerShell id: 112638b4-4634-11ec-b9ab-3e22fbd008af -version: 5 -date: '2024-12-10' +version: 15 +date: '2025-03-27' author: Mauricio Velazco, Splunk status: production type: TTP @@ -19,9 +19,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*" AND Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND Processes.process="*-Name - create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`' + create*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `remote_process_instantiation_via_wmi_and_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index 2338ea88f3..830f6215c6 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via WMI and PowerShell Script Block id: 2a048c14-4634-11ec-a618-3e22fbd008af -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -17,13 +17,13 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText="*Invoke-WmiMethod*" AND (ScriptBlockText="*-CN*" OR ScriptBlockText="*-ComputerName*") AND ScriptBlockText="*-Class Win32_Process*" - AND ScriptBlockText="*-Name create*" | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode ScriptBlockText Computer UserID| `security_content_ctime(firstTime)` + AND ScriptBlockText="*-Name create*" | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions - can be found - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users. @@ -31,12 +31,12 @@ references: - https://attack.mitre.org/techniques/T1047/ - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 drilldown_searches: -- name: View the detection results for - "$Computer$" - search: '%original_detection_search% | search Computer = "$Computer$"' +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -45,10 +45,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A process was started on a remote endpoint from $Computer$ by abusing WMI - using PowerShell.exe + message: A process was started on a remote endpoint from $dest$ by abusing WMI using + PowerShell.exe risk_objects: - - field: Computer + - field: dest type: system score: 63 threat_objects: [] @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index 33bc7de3b8..0420c5905e 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -1,6 +1,6 @@ name: Remote System Discovery with Adsisearcher id: 70803451-0047-4e12-9d63-77fa7eb8649c -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -17,9 +17,9 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*" AND ScriptBlockText IN ("*findAll()*","*findOne()*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest |rename UserID as user | `security_content_ctime(firstTime)` - | `remote_system_discovery_with_adsisearcher_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `remote_system_discovery_with_adsisearcher_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -42,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Remote system discovery enumeration with adsisearcher on $dest$ by $user$ + message: Remote system discovery enumeration with adsisearcher on $dest$ by $user_id$ risk_objects: - field: dest type: system @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml index 0f3b92aaf9..b5f44152e8 100644 --- a/detections/endpoint/remote_system_discovery_with_dsquery.yml +++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml @@ -1,6 +1,6 @@ name: Remote System Discovery with Dsquery id: 9fb562f4-42f8-4139-8e11-a82edf7ed718 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") - (Processes.process="*computer*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `remote_system_discovery_with_dsquery_filter`' + (Processes.process="*computer*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_dsquery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml index 6db545d4bf..678659757f 100644 --- a/detections/endpoint/remote_system_discovery_with_wmic.yml +++ b/detections/endpoint/remote_system_discovery_with_wmic.yml @@ -1,6 +1,6 @@ name: Remote System Discovery with Wmic id: d82eced3-b1dc-42ab-859e-a2fc98827359 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_computer* - AND Processes.process="*GET ds_samaccountname*") by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter`' + AND Processes.process="*GET ds_samaccountname*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `remote_system_discovery_with_wmic_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index 5bb7266b17..349c713ebd 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -1,6 +1,6 @@ name: Remote WMI Command Attempt id: 272df6de-61f1-4784-877c-1fbc3e2d0838 -version: 7 +version: 8 date: '2024-11-13' author: Rico Valdez, Michael Haag, Splunk status: production @@ -18,9 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process=*node* - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `remote_wmi_command_attempt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 56fa0680a6..805d8eb9a3 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -23,10 +23,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as where Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell.exe" OR Processes.parent_process_name = "powershell_ise.exe" OR Processes.parent_process_name = "wmic.exe" Processes.process_name = "vssadmin.exe" Processes.process="*resize*" - Processes.process="*shadowstorage*" Processes.process="*/maxsize*" by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.dest - Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `resize_shadowstorage_volume_filter`' + Processes.process="*shadowstorage*" Processes.process="*/maxsize*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `resize_shadowstorage_volume_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index a4b2b3f7f5..1f9592d34a 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Revil Common Exec Parameter id: 85facebe-c382-11eb-9c3e-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "* -nolan *" OR Processes.process = "* -nolocal *" OR Processes.process = "* -fast *" OR Processes.process - = "* -full *" by Processes.process_name Processes.process Processes.parent_process_name - Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + = "* -full *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index f6f6c0e032..febc39bf6a 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -1,6 +1,6 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -15,24 +15,16 @@ description: The following analytic identifies suspicious modifications in the r attackers to maintain persistence, encrypt files, and store critical ransomware-related information on compromised hosts. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" - OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") BY _time - span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `revil_registry_entry_filter`' + OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `revil_registry_entry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -87,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 8d0e78f4ef..997c6be4be 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -1,6 +1,6 @@ name: Rubeus Command Line Parameters id: cca37478-8377-11ec-b59a-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -24,10 +24,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*" OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*" OR Processes.process = "* brute* /password:*" OR Processes.process = "* brute* /passwords:*" - OR Processes.process ="* harvest*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`' + OR Processes.process ="* harvest*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -89,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 5950c1ca67..2994bb7ba7 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -1,6 +1,6 @@ name: Rubeus Kerberos Ticket Exports Through Winlogon Access id: 5ed8c50a-8869-11ec-876f-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,9 +19,12 @@ search: '`sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe ( (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time) - as firstTime max(_time) as lastTime by dest, SourceImage, SourceProcessId, TargetImage, - TargetProcessId, EventCode, GrantedAccess | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' + as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode + ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID + TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process_exec process_guid + process_id process_name process_path signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index 0ed47331a5..69a09ff757 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -1,6 +1,6 @@ name: Runas Execution in CommandLine id: 4807e716-43a4-11ec-a0e7-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_runas` AND Processes.process - = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user - Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`' + = "*/user:*" AND Processes.process = "*admin*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `runas_execution_in_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -53,7 +57,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/vilsel/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index b1ad8f7ef5..d9743f4a1f 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -1,6 +1,6 @@ name: Rundll32 Control RunDLL Hunt id: c8e7ced0-10c5-11ec-8b03-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,9 +18,12 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* by - Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_control_rundll_hunt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -59,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index 1d2585be25..457f7a21bf 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -1,6 +1,6 @@ name: Rundll32 Control RunDLL World Writable Directory id: 1adffe86-10c3-11ec-8ce6-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL* - AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") by - Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name + AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_control_rundll_world_writable_directory_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -90,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 7aca900e66..d4312ff4e3 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -1,6 +1,6 @@ name: Rundll32 Create Remote Thread To A Process id: 2dbeee3a-f067-11eb-96c0-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,13 @@ description: The following analytic detects the creation of a remote thread by r data_source: - Sysmon EventID 8 search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" - | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage - TargetProcessId SourceProcessId StartAddress EventCode dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId + ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress + StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest + parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path + process_exec process_guid process_id process_name process_path signature signature_id + user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `rundll32_create_remote_thread_to_a_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you @@ -64,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 0076a94683..0155ed9b96 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -1,6 +1,6 @@ name: Rundll32 CreateRemoteThread In Browser id: f8a22586-ee2d-11eb-a193-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,12 @@ data_source: - Sysmon EventID 8 search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) - as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId - StartAddress EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `rundll32_createremotethread_in_browser_filter`' + as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID + SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule + TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process_exec process_guid + process_id process_name process_path signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_createremotethread_in_browser_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you @@ -66,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 4f3f8a2188..e18797739a 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -1,6 +1,6 @@ name: Rundll32 LockWorkStation id: fa90f372-f91d-11eb-816c-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`' + Processes.process= "*user32.dll,LockWorkStation*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `rundll32_lockworkstation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index b3203c8ad4..4fcd4e901e 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -1,6 +1,6 @@ name: Rundll32 Process Creating Exe Dll Files id: 6338266a-ee2a-11eb-bf68-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,8 +15,8 @@ description: The following analytic detects a rundll32 process creating executab data_source: - Sysmon EventID 11 search: '`sysmon` EventCode=11 Image="*rundll32.exe" TargetFilename IN ("*.exe", "*.dll") - | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename - Computer | rename Computer as dest | rename TargetFilename as file_name | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name + file_path process_guid process_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your @@ -63,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index b2f5d5934a..dd2b27110a 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -1,6 +1,6 @@ name: Rundll32 Shimcache Flush id: a913718a-25b6-11ec-96d3-acde48001122 -version: 5 +version: 6 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process - = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' + = "*apphelp.dll,ShimFlushCache*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 23f1723414..1abab7ac49 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -1,6 +1,6 @@ name: Rundll32 with no Command Line Arguments with Network id: 35307032-a12d-11eb-835f-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Steven Dick, Michael Haag, Splunk status: production @@ -15,16 +15,37 @@ description: The following analytic detects the execution of rundll32.exe withou of the system. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where `process_rundll32` AND Processes.action!="blocked" - by host _time span=1h Processes.process_id Processes.process_name Processes.dest - Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(rundll32\.exe.{0,4}$)" | rename dest as src | join host process_id - [| tstats `security_content_summariesonly` count latest(All_Traffic.dest) as dest - latest(All_Traffic.dest_ip) as dest_ip latest(All_Traffic.dest_port) as dest_port - FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by host - All_Traffic.process_id | `drop_dm_object_name(All_Traffic)`] | `rundll32_with_no_command_line_arguments_with_network_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_rundll32` AND Processes.action!="blocked" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `rundll32_with_no_command_line_arguments_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -87,7 +108,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index fc41b88df5..7087d5b7a0 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -1,6 +1,6 @@ name: RunDLL Loading DLL By Ordinal id: 6c135f8d-5e60-454e-80b7-c56eed739833 -version: 10 +version: 11 date: '2025-02-10' author: Michael Haag, David Dorsey, Splunk status: production @@ -18,11 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") | - `rundll_loading_dll_by_ordinal_filter`' + where `process_rundll32` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where + match(process,"rundll32.+\#\d+") | `rundll_loading_dll_by_ordinal_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index e2fdf3bd6c..0156fd6b54 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -1,6 +1,6 @@ name: Ryuk Test Files Detected id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 -version: 4 +version: 5 date: '2024-11-13' author: Rod Soto, Jose Hernandez, Splunk status: production @@ -17,8 +17,11 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* - BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which @@ -64,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 4bfc808d08..d47ad551ef 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -1,6 +1,6 @@ name: Ryuk Wake on LAN Command id: 538d0152-7aaa-11eb-beaa-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*8 LAN*" - OR Processes.process="*9 REP*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `ryuk_wake_on_lan_command_filter`' + OR Processes.process="*9 REP*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 25bc5a6808..173c7a8881 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -1,6 +1,6 @@ name: Samsam Test File Write id: 493a879d-519d-428f-8f57-a06a0fdc107e -version: 4 +version: 5 date: '2024-11-13' author: Rico Valdez, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt - by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`' how_to_implement: You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which @@ -64,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index d08cad9a5b..9eb470e3b0 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -1,6 +1,6 @@ name: Sc exe Manipulating Windows Services id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d -version: 9 +version: 10 date: '2025-02-10' author: Rico Valdez, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="* - config *") by Processes.process_name Processes.parent_process_name Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter`' + config *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `sc_exe_manipulating_windows_services_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml index 1d84e7384b..59d238eeea 100644 --- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -1,6 +1,6 @@ name: SchCache Change By App Connect And Create ADSI Object id: 991eb510-0fc6-11ec-82d3-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,11 +15,15 @@ description: The following analytic detects an application attempting to connect within the network. data_source: - Sysmon EventID 11 -search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename - = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time) - as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `schcache_change_by_app_connect_and_create_adsi_object_filter`' +search: |- + `sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename + = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) + | stats count min(_time) + as firstTime max(_time) as lastTime by action dest file_name file_path process_guid + process_id user_id vendor_product process_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `schcache_change_by_app_connect_and_create_adsi_object_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -44,7 +48,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: process $Image$ create a file $TargetFilename$ in host $dest$ + message: Process $process_name$ created a file $file_name$ on host $dest$ risk_objects: - field: dest type: system @@ -64,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index f23eb706b0..3119d1ae64 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -1,6 +1,6 @@ name: Scheduled Task Creation on Remote Endpoint using At id: 4be54858-432f-11ec-8209-3e22fbd008af -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe - OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`' + OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `scheduled_task_creation_on_remote_endpoint_using_at_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index f8dd98ccb9..91961eeebd 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,7 +1,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c -version: '13' -date: '2025-02-24' +version: 14 +date: '2025-03-27' author: Bhavin Patel, Splunk status: production type: TTP @@ -20,9 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe - (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name - Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter`' + (Processes.process=*delete* OR Processes.process=*create*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `scheduled_task_deleted_or_created_via_cmd_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index e6122cd10f..dd331b984e 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -19,9 +19,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe) (Processes.process= "* /S *" AND Processes.process=*/run*) - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `scheduled_task_initiation_on_remote_endpoint_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 189d728507..ed057e794e 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -1,6 +1,6 @@ name: Schtasks Run Task On Demand id: bb37061e-af1f-11eb-a159-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -21,9 +21,13 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "schtasks.exe" - Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`' + Processes.process = "*/run*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 48b5d1fa98..104fda64cd 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -1,6 +1,6 @@ name: Schtasks scheduling job on remote system id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 -version: 12 +version: 13 date: '2025-02-10' author: David Dorsey, Mauricio Velazco, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = schtasks.exe OR Processes.original_file_name=schtasks.exe) (Processes.process="*/create*" AND - Processes.process="*/s*") by Processes.process_name Processes.process Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`' + Processes.process="*/s*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index ff5ff09caa..d9f6109f8d 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -1,6 +1,6 @@ name: Schtasks used for forcing a reboot id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6 -version: 9 +version: 10 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -20,7 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create - *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user + *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index e158fff091..9ffb31f772 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -1,6 +1,6 @@ name: Screensaver Event Trigger Execution id: 58cea3ec-1f6d-11ec-8560-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control - Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` + Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index 3e4e7d0663..fba0c46299 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -1,6 +1,6 @@ name: Script Execution via WMI id: aa73f80d-d728-4077-b226-81ea0c8be589 -version: 7 +version: 8 date: '2024-11-13' author: Rico Valdez, Michael Haag, Splunk status: production @@ -20,9 +20,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `script_execution_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index c6c89c02b0..3e0c8ae436 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -1,6 +1,6 @@ name: Sdclt UAC Bypass id: d71efbf6-da63-11eb-8c6e-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -14,24 +14,17 @@ description: The following analytic detects suspicious modifications to the sdcl privilege escalation, and potential persistence within the environment, posing a severe security risk. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name - = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")) BY _time span=1h - Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`' + = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")) by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `sdclt_uac_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 10aefc21a4..47e81ad9f6 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -1,6 +1,6 @@ name: Sdelete Application Execution id: 31702fc0-2682-11ec-85c3-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_sdelete` by Processes.process_name Processes.original_file_name - Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `sdelete_application_execution_filter`' + where `process_sdelete` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdelete_application_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index fc8584a30d..8f0ba79412 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -1,6 +1,6 @@ name: SearchProtocolHost with no Command Line with Network id: b690df8c-a145-11eb-a38b-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -15,15 +15,37 @@ description: The following analytic detects instances of searchprotocolhost.exe and control, potentially leading to data exfiltration or further system compromise. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id - Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats - `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port - | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name - process_name process_path process process_id dest_port C2 | `searchprotocolhost_with_no_command_line_with_network_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=searchprotocolhost.exe by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port != 0 by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `searchprotocolhost_with_no_command_line_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +100,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index fb76934525..c65492da7e 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -1,6 +1,6 @@ name: SecretDumps Offline NTDS Dumping Tool id: 5672819c-be09-11eb-bbfb-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe" Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*" OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process - = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name - Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `secretdumps_offline_ntds_dumping_tool_filter`' + = "*-bootkey*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `secretdumps_offline_ntds_dumping_tool_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index c584719964..568cc0f475 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -1,6 +1,6 @@ name: ServicePrincipalNames Discovery with PowerShell id: 13243068-2d38-11ec-8908-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the use of `powershell.exe` to query data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*" - | stats count min(_time) as firstTime max(_time) as lastTime by ScriptBlockText - Opcode Computer UserID EventCode | rename Computer as dest | rename UserID as user - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `serviceprincipalnames_discovery_with_powershell_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `serviceprincipalnames_discovery_with_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -38,12 +39,12 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -55,7 +56,7 @@ rba: message: An instance of attempting to identify service principle detected on $dest$ names. risk_objects: - - field: user + - field: user_id type: user score: 80 - field: dest @@ -79,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 1abd21eb3c..3cbff7af05 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -1,6 +1,6 @@ name: ServicePrincipalNames Discovery with SetSPN id: ae8b3efc-2d2e-11ec-8b57-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_setspn` (Processes.process="*-t*" AND Processes.process="*-f*") OR (Processes.process="*-q*" AND Processes.process="**/**") - OR (Processes.process="*-q*") OR (Processes.process="*-s*") by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `serviceprincipalnames_discovery_with_setspn_filter`' + OR (Processes.process="*-q*") OR (Processes.process="*-s*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `serviceprincipalnames_discovery_with_setspn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -90,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index dcfbd904f1..125ed133e1 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -1,6 +1,6 @@ name: Services Escalate Exe id: c448488c-b7ec-11eb-8253-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe - Processes.process_path=*admin$* by Processes.process_path Processes.dest Processes.user - Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + Processes.process_path=*admin$* by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_escalate_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/services_lolbas_execution_process_spawn.yml b/detections/endpoint/services_lolbas_execution_process_spawn.yml index 50ab6ea4fd..22cd55a917 100644 --- a/detections/endpoint/services_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_lolbas_execution_process_spawn.yml @@ -1,6 +1,6 @@ name: Services LOLBAS Execution Process Spawn id: ba9e1954-4c04-11ec-8b74-3e22fbd008af -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -29,10 +29,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", - "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`' + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `services_lolbas_execution_process_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -86,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 071b4ea163..a7e3bbd35a 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,7 +1,7 @@ name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 14 -date: '2025-02-28' +version: 15 +date: '2025-03-27' author: Steven Dick, Patrick Bareiss, Splunk status: production type: TTP @@ -13,23 +13,15 @@ description: The following analytic detects changes to the PowerShell ExecutionP confirmed malicious, this could enable an attacker to execute arbitrary code, leading to further compromise of the system and potential escalation of privileges. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted - OR Registry.registry_value_data=Bypass)) BY _time span=1h Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + OR Registry.registry_value_data=Bypass)) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -89,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 21bd64b76b..74e21fdc98 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -1,6 +1,6 @@ name: Shim Database File Creation id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 -version: 8 +version: 9 date: '2025-02-10' author: David Dorsey, Splunk status: production @@ -17,8 +17,11 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* - by Filesystem.file_name Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | + `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which @@ -64,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 37302453aa..7879ac2b79 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -1,6 +1,6 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 -version: 9 +version: 10 date: '2025-02-10' author: David Dorsey, Splunk status: production @@ -20,9 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", - "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.process_name - Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' + "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `shim_database_installation_with_suspicious_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index a18bda03a1..0c7e56afe0 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -1,6 +1,6 @@ name: SilentCleanup UAC Bypass id: 56d7cfcc-da63-11eb-92d4-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -14,22 +14,14 @@ description: The following analytic detects suspicious modifications to the regi this could lead to unauthorized administrative access, enabling further system compromise and persistence. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data - = "*.exe*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + = "*.exe*") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -82,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 8c6caa9566..b41d166e23 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -1,6 +1,6 @@ name: Single Letter Process On Endpoint id: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4 -version: 8 +version: 9 date: '2025-02-10' author: David Dorsey, Splunk status: production @@ -19,12 +19,15 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user, - Processes.process, Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | eval process_name_length = len(process_name), - endExe = if(substr(process_name, -4) == ".exe", 1, 0) | search process_name_length=5 - AND endExe=1 | table count, firstTime, lastTime, dest, user, process, process_name - | `single_letter_process_on_endpoint_filter`' + as lastTime from datamodel=Endpoint.Processes by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | eval process_name_length = len(process_name), endExe = if(substr(process_name, + -4) == ".exe", 1, 0) | search process_name_length=5 AND endExe=1 | `single_letter_process_on_endpoint_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index fccaeca2c1..d3017b42f5 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -1,6 +1,6 @@ name: SLUI RunAs Elevated id: 8d124810-b3e4-11eb-96c7-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe - (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter`' + (Processes.process=*-verb* Processes.process=*runas*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `slui_runas_elevated_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index 118a53b0ef..366a743d10 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -1,6 +1,6 @@ name: SLUI Spawning a Process id: 879c4330-b3e0-11eb-b1b1-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index e65d63e295..355a304e5b 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -1,7 +1,7 @@ name: Spoolsv Spawning Rundll32 id: 15d905f6-da6b-11eb-ab82-acde48001122 -version: '8' -date: '2025-03-03' +version: 9 +date: '2025-03-27' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -20,10 +20,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe - `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name - Processes.original_file_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `spoolsv_spawning_rundll32_filter`' + `process_rundll32` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_spawning_rundll32_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index fa3847f8b0..d64d76ce85 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -1,7 +1,7 @@ name: Spoolsv Suspicious Loaded Modules id: a5e451f8-da81-11eb-b245-acde48001122 -version: '7' -date: '2025-03-03' +version: 8 +date: '2025-03-27' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -16,8 +16,14 @@ data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) - as ImageLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer - ProcessId EventCode | rename Computer as dest | where countImgloaded >= 3 | `security_content_ctime(firstTime)` + as ImageLoaded values(loaded_file) as loaded_file values(loaded_file_path) as loaded_file_path + values(original_file_name) as original_file_name values(process_exec) as process_exec + values(process_guid) as process_guid values(process_hash) as process_hash values(process_name) + as process_name values(service_dll_signature_exists) as service_dll_signature_exists + values(service_dll_signature_verified) as service_dll_signature_verified values(signature) + as signature values(signature_id) as signature_id values(user_id) as user_id values(vendor_product) + as vendor_product values(Image) as Image count min(_time) as firstTime max(_time) as lastTime by process_path + dest process_id | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -40,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: $Image$ with process id $ProcessId$ has loaded a driver from $ImageLoaded$ + message: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. risk_objects: - field: dest diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index 3b7ec83687..de75324a63 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -1,7 +1,7 @@ name: Spoolsv Suspicious Process Access id: 799b606e-da81-11eb-93f8-acde48001122 -version: '7' -date: '2025-03-03' +version: 8 +date: '2025-03-27' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -17,9 +17,13 @@ data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | - stats count min(_time) as firstTime max(_time) as lastTime by dest SourceImage - TargetImage GrantedAccess CallTrace EventCode ProcessID| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`' + stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID + GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec + parent_process_guid parent_process_id parent_process_name parent_process_path process_exec + process_guid process_id process_name process_path signature signature_id user_id + vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `spoolsv_suspicious_process_access_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index a8fab8f7b0..ac3e2aeaef 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL id: d5bf5cf2-da71-11eb-92c2-acde48001122 -version: '8' -date: '2025-03-03' +version: 9 +date: '2025-03-27' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP @@ -14,20 +14,40 @@ description: The following analytic detects `spoolsv.exe` writing a `.dll` file, confirmed malicious, this could lead to unauthorized code execution and potential system compromise. Immediate endpoint isolation and further investigation are recommended. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -- Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=spoolsv.exe by _time Processes.process_guid Processes.process_name - Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| - tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" - Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.process_guid Filesystem.file_create_time - Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | - fields _time dest file_create_time file_name file_path process_name process_path - process_guid process] | dedup file_create_time | table dest file_create_time, file_name, - file_path, process_name process_guid | `spoolsv_writing_a_dll_filter`' +- Sysmon EventID 1 AND Sysmon EventID 11 +- Windows Event Log Security 4688 AND Sysmon EventID 11 +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=spoolsv.exe + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) + | `spoolsv_writing_a_dll_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 3fce3b68aa..04f1f2476a 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -1,8 +1,8 @@ name: Spoolsv Writing a DLL - Sysmon id: 347fd388-da87-11eb-836d-acde48001122 -version: '6' -date: '2025-03-03' -author: Mauricio Velazco, Michael Haag, Splunk +version: '7' +date: '2025-03-27' +author: Mauricio Velazco, Splunk status: production type: TTP description: The following analytic detects `spoolsv.exe` writing a `.dll` file, which @@ -17,8 +17,8 @@ data_source: - Sysmon EventID 11 search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by - dest, UserID, process_name, file_path, file_name, TargetFilename, process_id | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`' + action dest file_name file_path process_guid process_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -44,15 +44,13 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: $process_name$ has been identified writing dll's to $file_path$ on endpoint + message: A process has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. risk_objects: - field: dest type: system score: 72 threat_objects: - - field: process_name - type: process_name - field: file_name type: file_name tags: diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index abcf4b35d0..d6476ae1db 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -1,6 +1,6 @@ name: Sqlite Module In Temp Folder id: 0f216a38-f45f-11eb-b09c-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,8 @@ data_source: - Sysmon EventID 11 search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") | stats count min(_time) as - firstTime max(_time) as lastTime by dest signature signature_id process_name file_name - file_path action process_guid| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + firstTime max(_time) as lastTime by action dest file_name file_path process_guid + process_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sqlite_module_in_temp_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -41,14 +41,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Process $process_name$ create a file $file_name$ in host $dest$ + message: Process creates a file $file_name$ in host $dest$ risk_objects: - field: dest type: system score: 9 - threat_objects: - - field: process_name - type: process_name + threat_objects: [] tags: analytic_story: - IcedID @@ -63,7 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml index 4a2fde1696..5ef3ce8d63 100644 --- a/detections/endpoint/sunburst_correlation_dll_and_network_event.yml +++ b/detections/endpoint/sunburst_correlation_dll_and_network_event.yml @@ -1,6 +1,6 @@ name: Sunburst Correlation DLL and Network Event id: 701a8740-e8db-40df-9190-5516d3819787 -version: 4 +version: 5 date: '2024-11-13' author: Patrick Bareiss, Splunk status: experimental @@ -17,10 +17,11 @@ data_source: - Sysmon EventID 22 search: (`sysmon` EventCode=7 ImageLoaded=*SolarWinds.Orion.Core.BusinessLayer.dll) OR (`sysmon` EventCode=22 QueryName=*avsvmcloud.com) | eventstats dc(EventCode) - AS dc_events | where dc_events=2 | stats min(_time) as firstTime max(_time) as lastTime - values(ImageLoaded) AS ImageLoaded values(QueryName) AS QueryName by host | rename - host as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `sunburst_correlation_dll_and_network_event_filter` + AS dc_events | where dc_events=2 | stats count min(_time) as firstTime max(_time) + as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `sunburst_correlation_dll_and_network_event_filter` how_to_implement: This detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index f7e4fd4845..744ffbb470 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -1,7 +1,7 @@ name: Suspicious Copy on System32 id: ce633e56-25b2-11ec-9e76-acde48001122 -version: 7 -date: '2025-02-21' +version: 8 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -21,12 +21,15 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*") - AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | eval splitted_commandline=split(process," - ") | eval first_cmdline=lower(mvindex(splitted_commandline,0)) | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") - AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%") | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` |`suspicious_copy_on_system32_filter`' + AND Processes.process = "*copy*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | eval splitted_commandline=split(process," ") | eval first_cmdline=lower(mvindex(splitted_commandline,0)) + | where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`suspicious_copy_on_system32_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_curl_network_connection.yml b/detections/endpoint/suspicious_curl_network_connection.yml index 82b88a7252..eae5a20bd9 100644 --- a/detections/endpoint/suspicious_curl_network_connection.yml +++ b/detections/endpoint/suspicious_curl_network_connection.yml @@ -1,6 +1,6 @@ name: Suspicious Curl Network Connection id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: experimental @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl - Processes.process=s3.amazonaws.com by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `suspicious_curl_network_connection_filter`' + Processes.process=s3.amazonaws.com by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_curl_network_connection_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 2a3b40ce3e..398d97df35 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Suspicious DLLHost no Command Line Arguments id: ff61e98c-0337-4593-a78f-72a676c56f26 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`' + where `process_dllhost` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex + process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 9dd5badbbf..a905407a44 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Suspicious GPUpdate no Command Line Arguments id: f308490a-473a-40ef-ae64-dd7a6eba284a -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`' + where `process_gpupdate` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex + process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 0af0bc7214..67f2c841c9 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -1,6 +1,6 @@ name: Suspicious IcedID Rundll32 Cmdline id: bed761f8-ee29-11eb-8bf3-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*/i:* - by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process - Processes.process_id Processes.parent_process_id Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_icedid_rundll32_cmdline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 101fd0c2cb..9cc0d39dc3 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -1,6 +1,6 @@ name: Suspicious Image Creation In Appdata Folder id: f6f904c4-1ac0-11ec-806b-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,17 +15,39 @@ description: The following analytic detects the creation of image files in the A compromising sensitive information and user privacy. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= - "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time - Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid | fields _time dest file_create_time file_name - file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe + Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path="*\\appdata\\Roaming\\*" + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) + | `suspicious_image_creation_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -71,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml index 4012c6fa6d..b5bd2f3e97 100644 --- a/detections/endpoint/suspicious_linux_discovery_commands.yml +++ b/detections/endpoint/suspicious_linux_discovery_commands.yml @@ -1,6 +1,6 @@ name: Suspicious Linux Discovery Commands id: 0edd5112-56c9-11ec-b990-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Bhavin Patel, Splunk status: production @@ -14,17 +14,23 @@ description: The following analytic detects the execution of suspicious bash com information, identify vulnerabilities, and potentially escalate privileges, posing a severe threat to the environment. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process) - values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process) - as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time) - as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where [|inputlookup - linux_tool_discovery_process | rename process as Processes.process |table Processes.process] - by _time span=5m Processes.user Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| where - distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`' +- Sysmon for Linux EventID 1 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.action) as action values(Processes.original_file_name) + as original_file_name values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_name) + as parent_process_name values(Processes.parent_process_path) as parent_process_path + values(Processes.process) as process values(Processes.process_exec) as process_exec + values(Processes.process_guid) as process_guid values(Processes.process_hash) as + process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) + as user_id values(Processes.vendor_product) as vendor_product dc(Processes.process) + as distinct_commands dc(Processes.process_name) as distinct_process_names from datamodel=Endpoint.Processes + where [|inputlookup linux_tool_discovery_process | rename process as Processes.process + |table Processes.process] by _time span=5m Processes.user Processes.dest | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where + distinct_commands > 40 AND distinct_process_names > 3 | `suspicious_linux_discovery_commands_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 4484fb6321..0f3b36c71c 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -1,6 +1,6 @@ name: Suspicious microsoft workflow compiler rename id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=microsoft.workflow.compiler.exe - AND Processes.original_file_name=Microsoft.Workflow.Compiler.exe by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.original_file_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + AND Processes.original_file_name=Microsoft.Workflow.Compiler.exe by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_rename_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -57,7 +60,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 18c7eafe0b..d7f25f34e2 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -1,6 +1,6 @@ name: Suspicious microsoft workflow compiler usage id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler` - by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `suspicious_microsoft_workflow_compiler_usage_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index fc2f44999f..c297f11693 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -1,6 +1,6 @@ name: Suspicious msbuild path id: f5198224-551c-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,7 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=*\\framework*\\v*\\*) - by Processes.dest Processes.original_file_name Processes.parent_process Processes.user + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index f9bd30e77d..e93ac70537 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -1,6 +1,6 @@ name: Suspicious MSBuild Rename id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name!=msbuild.exe - AND Processes.original_file_name=MSBuild.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_msbuild_rename_filter`' + AND Processes.original_file_name=MSBuild.exe by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `suspicious_msbuild_rename_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -58,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index 897b1fd22e..ae55e276bb 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -1,6 +1,6 @@ name: Suspicious MSBuild Spawn id: a115fba6-5514-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe - AND `process_msbuild` by Processes.dest Processes.parent_process Processes.original_file_name - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`' + AND `process_msbuild` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 7e5a50e44b..c6c8e2f0ce 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -1,6 +1,6 @@ name: Suspicious mshta child process id: 60023bb6-5500-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -17,16 +17,19 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) - as process_name values(Processes.process) as process min(_time) as firstTime max(_time) +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe OR Processes.process_name=msbuild.exe OR Processes.process_name=microsoft.workflow.compiler.exe OR Processes.process_name=searchprotocolhost.exe OR Processes.process_name=scrcons.exe OR Processes.process_name=cscript.exe OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe - OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `suspicious_mshta_child_process_filter`' + OR Processes.process_name=cmd.exe) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_child_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index bffd402f2c..3a8d8ea1bb 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -1,6 +1,6 @@ name: Suspicious mshta spawn id: 4d33a488-5b5f-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,9 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe - OR Processes.parent_process_name=wmiprvse.exe) AND `process_mshta` by Processes.dest - Processes.parent_process Processes.user Processes.original_file_name| `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`' + OR Processes.parent_process_name=wmiprvse.exe) AND `process_mshta` by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `suspicious_mshta_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 61d0e8d0ad..8be239d567 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -1,6 +1,6 @@ name: Suspicious Process Executed From Container File id: d8120352-3b62-411c-8cb6-7b47584dd5e8 -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production @@ -19,8 +19,13 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") - AND Processes.action="allowed" by Processes.dest Processes.parent_process Processes.process - Processes.user| `drop_dm_object_name(Processes)`| regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" + AND Processes.action="allowed" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" | rex field=process "(?i).+\\\\(?[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -81,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 0add6178bb..13523532b8 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -1,6 +1,6 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -version: 9 +version: 10 date: '2024-11-13' author: David Dorsey, Splunk status: production @@ -20,8 +20,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name - != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name - Processes.parent_process_name Processes.dest Processes.process_id Processes.parent_process_id + != explorer.exe Processes.process_name =cmd.exe by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe by Processes.parent_process_id @@ -87,7 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index f4e90ec9b2..d009b01ced 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,7 +1,7 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: '13' -date: '2025-02-24' +version: 14 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: TTP @@ -20,9 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process - IN ("*.dll*", "*.ax*", "*.ocx*")) by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.original_file_name - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + IN ("*.dll*", "*.ax*", "*.ocx*")) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 3a91a79903..56e226eb0e 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Suspicious Rundll32 dllregisterserver id: 8c00a385-9b86-4ac0-8932-c9ec3713b159 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver* - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.original_file_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_rundll32_dllregisterserver_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `suspicious_rundll32_dllregisterserver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -87,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml index a409f211ca..563a0fc5e4 100644 --- a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Suspicious Rundll32 no Command Line Arguments id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`' + where `process_rundll32` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex + process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index 1d83ad1012..f7c649ce9b 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -1,6 +1,6 @@ name: Suspicious Rundll32 PluginInit id: 92d51712-ee29-11eb-b1ae-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*PluginInit* - by Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name - Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest - Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `suspicious_rundll32_plugininit_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 734b077b09..7760a93a89 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -1,6 +1,6 @@ name: Suspicious Rundll32 StartW id: 9319dda5-73f2-4d43-a85a-67ce961bddb7 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*start* - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_startw_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 2f4d734922..f1afcb005e 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -1,7 +1,7 @@ name: Suspicious Scheduled Task from Public Directory id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: '7' -date: '2025-02-24' +version: 8 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: Anomaly @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR - Processes.process=*windows\\temp*) Processes.process=*/create* by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`' + Processes.process=*windows\\temp*) Processes.process=*/create* by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `suspicious_scheduled_task_from_public_directory_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index 99ee59cae4..6cd8b789c9 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Suspicious SearchProtocolHost no Command Line Arguments id: f52d2db8-31f9-4aa7-a176-25779effe55c -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,11 +18,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id - Processes.process_name Processes.dest Processes.user Processes.process_path Processes.process - Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" - | `suspicious_searchprotocolhost_no_command_line_arguments_filter`' + where Processes.process_name=searchprotocolhost.exe by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml index 970e1f8f20..16925a2c26 100644 --- a/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml +++ b/detections/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml @@ -1,6 +1,6 @@ name: Suspicious SQLite3 LSQuarantine Behavior id: e1997b2e-655f-4561-82fd-aeba8e1c1a86 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: experimental @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sqlite3 - Processes.process=*LSQuarantine* by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `suspicious_sqlite3_lsquarantine_behavior_filter`' + Processes.process=*LSQuarantine* by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_sqlite3_lsquarantine_behavior_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index ea46ed5259..9464b212cf 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -1,6 +1,6 @@ name: Suspicious WAV file in Appdata Folder id: 5be109e6-1ac5-11ec-b421-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -14,21 +14,41 @@ description: The following analytic detects the creation of .wav files in the Ap information being sent to an attacker's command and control server, compromising the affected system's confidentiality. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -- Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count - min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem +- Sysmon EventID 1 AND Sysmon EventID 11 +- Windows Event Log Security 4688 AND Sysmon EventID 11 +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe + Processes.process_path="*\\appdata\\Roaming\\*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid | fields file_name file_path process_name process_path - process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) + | `suspicious_wav_file_in_appdata_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least @@ -74,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 39b6278f58..64b4701545 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,6 +1,6 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 10 +version: 11 date: '2025-02-10' author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*", "* -cl *") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*", - "*trace*", "*powershell*") by Processes.parent_process_name Processes.parent_process - Processes.process Processes.process_guid Processes.process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` - | `suspicious_wevtutil_usage_filter`' + "*trace*", "*powershell*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index b179bc80c6..ce4e741840 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -1,6 +1,6 @@ name: Suspicious writes to windows Recycle Bin id: b5541828-8ffd-4070-9d95-b3da4de924cb -version: 5 +version: 6 date: '2024-11-13' author: Rico Valdez, Splunk status: production @@ -15,15 +15,38 @@ description: The following analytic detects when a process other than explorer.e tools. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) - as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*" - by Filesystem.process_name Filesystem.process_id Filesystem.dest | `drop_dm_object_name("Filesystem")` - | join process_id [| tstats `security_content_summariesonly` values(Processes.user) - as user values(Processes.process_name) as process_name values(Processes.parent_process_name) - as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name - != "explorer.exe" by Processes.process_id Processes.dest | `drop_dm_object_name("Processes")` - | table user process_name process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name + != "explorer.exe" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path + = "*$Recycle.Bin*" by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) + | `suspicious_writes_to_windows_recycle_bin_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes. @@ -69,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index ef195b0980..95ed69ec10 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -1,6 +1,6 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -29,8 +29,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", - "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + "Msconfig.exe")) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -84,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index 39d3aac52b..d443ae2127 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -1,6 +1,6 @@ name: System Info Gathering Using Dxdiag Application id: f92d74f2-4921-11ec-b685-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,8 +19,11 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process - = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + = "* /t *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_info_gathering_using_dxdiag_application_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 095ef26ee7..b18446019f 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -1,6 +1,6 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 7 +version: 8 date: '2024-12-16' author: Patrick Bareiss, Splunk status: production @@ -19,10 +19,21 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" - OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user - Processes.process_name Processes.process Processes.dest Processes.parent_process_name + OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest - by dest | where dc_processes_by_dest > 2 | stats values(process) as process min(firstTime) + by dest | where dc_processes_by_dest > 2 | stats values(process) as process values(action) + as action values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_path) + as parent_process_path values(process_exec) as process_exec values(process_guid) + as process_guid values(.process_hash) as process_hash values(process_id) as process_id + values(process_integrity_level) as process_integrity_level values(process_path) + as process_path values(user_id) as user_id values(vendor_product) as vendor_product min(firstTime) as firstTime max(lastTime) as lastTime by user, dest parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 4821dfd05e..52ded1d414 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,6 +1,6 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 10 +version: 11 date: '2025-02-10' author: David Dorsey, Michael Haag, Splunk status: production @@ -18,11 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" - Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest Processes.user - Processes.parent_process Processes.process_path Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file_macro` - | `system_processes_run_from_unexpected_locations_filter`' + Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `is_windows_system_file_macro` | `system_processes_run_from_unexpected_locations_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index cd0788aeb9..517614b6d4 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -1,6 +1,6 @@ name: System User Discovery With Query id: ad03bfcf-8a91-4bc2-a500-112993deba87 -version: 5 +version: 6 date: '2025-02-05' author: Mauricio Velazco, Splunk status: production @@ -17,10 +17,16 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") - AND Processes.process="*user*" AND ((NOT Processes.process="*/server*") OR Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*")) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `system_user_discovery_with_query_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" + OR Processes.original_file_name="query.exe") AND Processes.process="*user*" AND + ((NOT Processes.process="*/server*") OR Processes.process IN ("*/server:localhost*", + "*/server:127.0.0.1*")) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_query_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -47,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 594b175c8d..d1a3e665a0 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -1,6 +1,6 @@ name: System User Discovery With Whoami id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="whoami.exe") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `system_user_discovery_with_whoami_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -41,6 +45,7 @@ tags: - Rhysida Ransomware - Qakbot - CISA AA23-347A + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint mitre_attack_id: - T1033 @@ -52,7 +57,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 29378235ab..cdd16a30c0 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,6 +1,6 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,8 +17,9 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") - BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 409104955e..778873856c 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -1,6 +1,6 @@ name: Trickbot Named Pipe id: 1804b0a4-a682-11eb-8f68-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,10 @@ data_source: - Sysmon EventID 17 - Sysmon EventID 18 search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats min(_time) - as firstTime max(_time) as lastTime count by dest user_id EventCode PipeName signature - Image process_id | rename Image as process_name | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter`' + as firstTime max(_time) as lastTime count by dest dvc pipe_name process_exec process_guid + process_id process_name process_path signature signature_id user_id vendor_product + Image PipeName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `trickbot_named_pipe_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index 03661c70d7..12df8b9de7 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -1,6 +1,6 @@ name: UAC Bypass MMC Load Unsigned Dll id: 7f04349c-e30d-11eb-bc7f-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ description: The following analytic detects the loading of an unsigned DLL by th data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false - Company != "Microsoft Corporation" | stats count min(_time) as firstTime max(_time) - as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName dest EventCode - Company | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `uac_bypass_mmc_load_unsigned_dll_filter`' + Company != "Microsoft Corporation" | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `uac_bypass_mmc_load_unsigned_dll_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -44,7 +45,6 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $dest$ - with EventCode $EventCode$ risk_objects: - field: dest type: system @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 3b5ec1cdb6..85cd67c5c2 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -1,6 +1,6 @@ name: UAC Bypass With Colorui COM Object id: 2bcccd20-fc2b-11eb-8d22-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,11 @@ description: The following analytic detects a potential UAC bypass using the col data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" - NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as - firstTime max(_time) as lastTime by Image ImageLoaded process_name dest user_id - EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + NOT(Image IN("*\\windows\\*", "*\\program files*")) | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path + original_file_name process_exec process_guid process_hash process_id process_name + process_path service_dll_signature_exists service_dll_signature_verified signature + signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -63,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index 06248d5f3b..25daf99ff7 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -1,6 +1,6 @@ name: Uninstall App Using MsiExec id: 1fca2b28-f922-11eb-b2dd-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msiexec.exe Processes.process= "* /qn *" Processes.process= "*/X*" Processes.process= "*REBOOT=*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uninstall_app_using_msiexec_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `uninstall_app_using_msiexec_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index f1a31e9ae9..b907525320 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -1,6 +1,6 @@ name: Unknown Process Using The Kerberos Protocol id: c91a0852-9fbb-11ec-af44-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -15,14 +15,37 @@ description: The following analytic identifies a non-lsass.exe process making an access or lateral movement within the network. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name!=lsass.exe by _time Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | join process_id dest [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port = 88 by All_Traffic.src All_Traffic.process_id All_Traffic.dest_port - | `drop_dm_object_name(All_Traffic)` | rename src as dest ] | table _time dest - parent_process_name process_name process_path process process_id dest_port | `unknown_process_using_the_kerberos_protocol_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name!=lsass.exe by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where + All_Traffic.dest_port = 88 by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `unknown_process_using_the_kerberos_protocol_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,11 +97,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 74f3715365..48405327e2 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -1,6 +1,6 @@ name: Unload Sysmon Filter Driver id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe -version: 8 +version: 9 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -18,9 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fltMC.exe - AND Processes.process=*unload* AND Processes.process=*SysmonDrv* by Processes.process_name - Processes.process_id Processes.parent_process_name Processes.process Processes.dest - Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + AND Processes.process=*unload* AND Processes.process=*SysmonDrv* by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | table firstTime lastTime dest user count process_name process_id parent_process_name process | `unload_sysmon_filter_driver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -71,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index 63a2cee57d..3dbd8dbd42 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -1,6 +1,6 @@ name: Unloading AMSI via Reflection id: a21e3484-c94d-11eb-b55b-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the tampering of AMSI (Antimalware S data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = *system.management.automation.amsi* - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unloading_amsi_via_reflection_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -44,9 +45,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Possible AMSI Unloading via Reflection using PowerShell on $Computer$ + message: Possible AMSI Unloading via Reflection using PowerShell on $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 49 threat_objects: [] @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index 58affd514e..250a39176b 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -1,6 +1,6 @@ name: Unusual Number of Kerberos Service Tickets Requested id: eb3e6702-8936-11ec-98fe-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Mauricio Velazco, Dean Luxton, Splunk status: production @@ -14,16 +14,13 @@ description: The following analytic identifies an unusual number of Kerberos ser to sensitive accounts and escalation of privileges within the Active Directory environment. data_source: - Windows Event Log Security 4769 -search: >- - `wineventlog_security` EventCode=4769 ServiceName!="*$" TicketEncryptionType=0x17 +search: '`wineventlog_security` EventCode=4769 ServiceName!="*$" TicketEncryptionType=0x17 | bucket span=2m _time | stats dc(ServiceName) AS unique_services values(ServiceName) as requested_services values(user_category) as user_category values(src_category) - as src_category by _time, user, src - | eventstats avg(unique_services) as comp_avg , stdev(unique_services) as comp_std - by user, src - | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_services > 2 - and unique_services >= upperBound, 1, 0) | search isOutlier=1 - | `unusual_number_of_kerberos_service_tickets_requested_filter` + as src_category values(dest) as dest by _time, user, src | eventstats avg(unique_services) + as comp_avg , stdev(unique_services) as comp_std by user, src | eval upperBound=(comp_avg+comp_std*3) | + eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0) | + search isOutlier=1 | `unusual_number_of_kerberos_service_tickets_requested_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -73,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/unusual_number_of_kerberos_service_tickets_requested/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/unusual_number_of_kerberos_service_tickets_requested/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index bf72181614..989043e935 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -1,6 +1,6 @@ name: Unusually Long Command Line id: c77162d3-f93c-45cc-80c8-22f6a4264e7f -version: 8 +version: 9 date: '2024-11-13' author: David Dorsey, Splunk status: experimental @@ -18,13 +18,17 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name - Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| eval processlen=len(process) | eventstats stdev(processlen) - as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev) - as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process - | `unusually_long_command_line_filter` |eval threshold = 3 | where maxlen > ((threshold*stdevperhost) - + avgperhost)' + as lastTime FROM datamodel=Endpoint.Processes by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| eval + processlen=len(process) | eventstats stdev(processlen) as stdev, avg(processlen) + as avg by dest | stats max(processlen) as maxlen, values(stdev) as stdevperhost, + values(avg) as avgperhost by dest, user, process_name, process | `unusually_long_command_line_filter` + |eval threshold = 3 | where maxlen > ((threshold*stdevperhost) + avgperhost)' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/unusually_long_command_line___mltk.yml b/detections/endpoint/unusually_long_command_line___mltk.yml index a1449bf5e2..517981b6a1 100644 --- a/detections/endpoint/unusually_long_command_line___mltk.yml +++ b/detections/endpoint/unusually_long_command_line___mltk.yml @@ -1,6 +1,6 @@ name: Unusually Long Command Line - MLTK id: 57edaefa-a73b-45e5-bbae-f39c1473f941 -version: 5 +version: 6 date: '2024-12-16' author: Rico Valdez, Splunk status: experimental @@ -17,12 +17,16 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name - Processes.process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| eval processlen=len(process) | search user!=unknown - | apply cmdline_pdfmodel threshold=0.01 | rename "IsOutlier(processlen)" as isOutlier - | search isOutlier > 0 | table firstTime lastTime user dest process_name process - processlen count | `unusually_long_command_line___mltk_filter`' + as lastTime FROM datamodel=Endpoint.Processes by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + eval processlen=len(process) | search user!=unknown | apply cmdline_pdfmodel threshold=0.01 + | rename "IsOutlier(processlen)" as isOutlier | search isOutlier > 0 | table firstTime + lastTime user dest process_name process processlen count | `unusually_long_command_line___mltk_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml index 79d4aea5e9..cc31ead507 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml @@ -1,6 +1,6 @@ name: User Discovery With Env Vars PowerShell id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `user_discovery_with_env_vars_powershell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -49,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 840a2991e0..c8b9cfffb5 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -1,6 +1,6 @@ name: User Discovery With Env Vars PowerShell Script Block id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the use of PowerShell environment va data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*$env:UserName*" OR ScriptBlockText - = "*[System.Environment]::UserName*") | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode ScriptBlockText Computer user_id | rename Computer as dest, - user_id as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `user_discovery_with_env_vars_powershell_script_block_filter`' + = "*[System.Environment]::UserName*") | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -41,7 +41,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index 7be7337d7e..5e3d7de7eb 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -1,6 +1,6 @@ name: USN Journal Deletion id: b6e0ff70-b122-4227-9368-4cf322ab43c3 -version: 5 +version: 6 date: '2024-11-13' author: David Dorsey, Splunk status: production @@ -20,8 +20,12 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe - by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search process="*deletejournal*" AND process="*usn*" | `usn_journal_deletion_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -70,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 1924be3cfb..a8848fa26a 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -1,6 +1,6 @@ name: Vbscript Execution Using Wscript App id: 35159940-228f-11ec-8a49-acde48001122 -version: 6 +version: 7 date: '2025-02-19' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name - = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process_id Processes.process - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`' + = "wscript.exe" AND Processes.process = "*//e:vbscript*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `vbscript_execution_using_wscript_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index f45344915b..754649a4c0 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -1,6 +1,6 @@ name: Verclsid CLSID Execution id: 61e9a56a-20fa-11ec-8ba3-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_verclsid` AND Processes.process="*/S*" Processes.process="*/C*" AND Processes.process="*{*" - AND Processes.process="*}*" by Processes.process_name Processes.original_file_name - Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `verclsid_clsid_execution_filter`' + AND Processes.process="*}*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `verclsid_clsid_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -53,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 21d2e3fb4f..06125dcc35 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -1,6 +1,6 @@ name: W3WP Spawning Shell id: 0f03423c-7c6a-11eb-bc47-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,9 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=w3wp.exe - AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process - Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`' + AND `process_cmd` OR `process_powershell` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,6 +77,7 @@ tags: - CISA AA22-264A - Flax Typhoon - WS FTP Server Critical Vulnerabilities + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint cve: - CVE-2021-34473 @@ -88,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 01aead7047..c42cdcb33a 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -1,6 +1,6 @@ name: WBAdmin Delete System Backups id: cd5aed7e-5cea-11eb-ae93-0242ac130002 -version: 5 +version: 6 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -18,9 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wbadmin` AND Processes.process="*delete*" - AND (Processes.process="*catalog*" OR Processes.process="*backup*") by Processes.process_name - Processes.process Processes.parent_process_name Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + AND (Processes.process="*catalog*" OR Processes.process="*backup*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 3a63ebc37c..a7b63ba7e6 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -1,6 +1,6 @@ name: Wbemprox COM Object Execution id: 9d911ce0-c3be-11eb-b177-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) - NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time) - as firstTime max(_time) as lastTime by Image ImageLoaded process_name dest EventCode - Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `wbemprox_com_object_execution_filter`' + NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file + loaded_file_path original_file_name process_exec process_guid process_hash process_id + process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wbemprox_com_object_execution_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/endpoint/web_servers_executing_suspicious_processes.yml similarity index 79% rename from detections/application/web_servers_executing_suspicious_processes.yml rename to detections/endpoint/web_servers_executing_suspicious_processes.yml index 728ef8c11c..f3ebb90e10 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/endpoint/web_servers_executing_suspicious_processes.yml @@ -1,6 +1,6 @@ name: Web Servers Executing Suspicious Processes id: ec3b7601-689a-4463-94e0-c9f45638efb9 -version: 4 +version: 5 date: '2025-01-21' author: David Dorsey, Splunk status: experimental @@ -19,8 +19,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.dest_category="web_server" AND (Processes.process="*whoami*" OR Processes.process="*ping*" OR Processes.process="*iptables*" OR Processes.process="*wget*" OR Processes.process="*service*" OR Processes.process="*curl*") - by Processes.process Processes.process_name, Processes.dest Processes.user| `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `web_servers_executing_suspicious_processes_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index f648718227..8c3ad7e96b 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -1,6 +1,6 @@ name: Wermgr Process Create Executable File id: ab3bcce0-a105-11eb-973c-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,9 @@ description: The following analytic detects the wermgr.exe process creating an e data_source: - Sysmon EventID 11 search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" - | stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename - process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `wermgr_process_create_executable_file_filter`' + | stats min(_time) as firstTime max(_time) as lastTime count by action dest file_name + file_path process_guid process_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wermgr_process_create_executable_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -61,7 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index 73dc26d297..ff5005175c 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -1,6 +1,6 @@ name: Wermgr Process Spawned CMD Or Powershell Process id: e8fc95bc-a107-11eb-a978-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "wermgr.exe" `process_cmd` OR `process_powershell` - by Processes.parent_process_name Processes.original_file_name Processes.parent_process_id Processes.process_name - Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_spawned_cmd_or_powershell_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index 6e8ced3331..58e34abd66 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -1,6 +1,6 @@ name: Wget Download and Bash Execution id: 35682718-5a85-11ec-b8f7-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk, DipsyTipsy status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=wget OR Processes.process_name=wget.exe) ((Processes.process="*-q *" OR Processes.process="*-q" OR Processes.process="*--quiet*") AND Processes.process="*-O- *") AND (Processes.process="*|*" - AND Processes.process="*bash*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `wget_download_and_bash_execution_filter`' + AND Processes.process="*bash*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wget_download_and_bash_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -89,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index cc2242510c..28005dd373 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,7 +1,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: '12' -date: '2025-02-24' +version: 13 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugP "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) | stats count min(_time) as firstTime max(_time) as lastTime by Computer ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList - action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + action dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_sedebugprivilege_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index dd647d1112..957a0d2fda 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -1,6 +1,6 @@ name: Windows Access Token Manipulation Winlogon Duplicate Token Handle id: dda126d7-1d99-4f0b-b72a-4c14031f9398 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,12 @@ data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime - by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId - GrantedAccess CallTrace dest user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' + by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage + SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId + UserID dest granted_access parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process_exec process_guid process_id process_name + process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 @@ -43,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index 662e51dcaf..1fafbf3d87 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -1,6 +1,6 @@ name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path id: b8f7ed6b-0556-4c84-bffd-839c262b0278 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,12 @@ data_source: search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as - lastTime by Computer SourceImage TargetImage SourceProcessGUID TargetProcessGUID - SourceProcessId TargetProcessId GrantedAccess CallTrace | rename Computer as dest| - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`' + lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage + SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId + UserID dest granted_access parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process_exec process_guid process_id process_name + process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 @@ -68,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml index efd6e3dd18..599f0d52c1 100644 --- a/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml +++ b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml @@ -1,24 +1,28 @@ name: Windows Account Access Removal via Logoff Exec id: 223572ab-8768-4e20-9b39-c38707af80dc -version: 2 +version: 3 date: '2025-02-10' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 1 type: Anomaly status: production -description: The following analytic detects the process of logging off a user through - the use of the quser and logoff commands. By monitoring for these commands, the - analytic identifies actions where a user session is forcibly terminated, which could - be part of an administrative task or a potentially unauthorized access attempt. - This detection helps identify potential misuse or malicious activity where a user’s - access is revoked without proper authorization, providing insight into potential - security incidents involving account management or session manipulation. +description: "The following analytic detects the process of logging off a user through\ + \ the use of the quser and logoff commands. By monitoring for these commands, the\ + \ analytic identifies actions where a user session is forcibly terminated, which\ + \ could be part of an administrative task or a potentially unauthorized access attempt.\ + \ This detection helps identify potential misuse or malicious activity where a user\u2019\ + s access is revoked without proper authorization, providing insight into potential\ + \ security incidents involving account management or session manipulation." search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = logoff.exe - by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_account_access_removal_via_logoff_exec_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_account_access_removal_via_logoff_exec_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -64,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml b/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml index 7ddbfdb697..8a24683df4 100644 --- a/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml +++ b/detections/endpoint/windows_account_discovery_for_none_disable_user_account.yml @@ -1,6 +1,6 @@ name: Windows Account Discovery for None Disable User Account id: eddbf5ba-b89e-47ca-995e-2d259804e55e -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the execution of the PowerView Power for further exploitation. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or lateral movement within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-NetUser*" ScriptBlockText - = "*NOT_ACCOUNTDISABLE*" ScriptBlockText = "*-UACFilter*" | rename Computer as dest, - UserID as user | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_account_discovery_for_none_disable_user_account_filter`' + = "*NOT_ACCOUNTDISABLE*" ScriptBlockText = "*-UACFilter*" | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id + vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_account_discovery_for_none_disable_user_account_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= @@ -44,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_account_discovery_for_sam_account_name.yml b/detections/endpoint/windows_account_discovery_for_sam_account_name.yml index 13e239cb64..a9c8b57f1a 100644 --- a/detections/endpoint/windows_account_discovery_for_sam_account_name.yml +++ b/detections/endpoint/windows_account_discovery_for_sam_account_name.yml @@ -1,6 +1,6 @@ name: Windows Account Discovery for Sam Account Name id: 69934363-e1dd-4c49-8651-9d7663dd4d2f -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the execution of the PowerView Power this activity could allow an attacker to map out user accounts, potentially leading to further exploitation and unauthorized access within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-NetUser*" ScriptBlockText - IN ("*samaccountname*", "*pwdlastset*") | rename Computer as dest, UserID as user - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_account_discovery_for_sam_account_name_filter`' + IN ("*samaccountname*", "*pwdlastset*") | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_account_discovery_for_sam_account_name_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml b/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml index 27a5351a7d..64367c7e25 100644 --- a/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml +++ b/detections/endpoint/windows_account_discovery_with_netuser_preauthnotrequire.yml @@ -1,6 +1,6 @@ name: Windows Account Discovery With NetUser PreauthNotRequire id: cf056b65-44b2-4d32-9172-d6b6f081a376 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the PowerView Power accounts. If confirmed malicious, this behavior could lead to further exploitation, such as unauthorized access or privilege escalation within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-NetUser*" ScriptBlockText - = "*-PreauthNotRequire*" | rename Computer as dest, UserID as user | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_account_discovery_with_netuser_preauthnotrequire_filter`' + = "*-PreauthNotRequire*" | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_account_discovery_with_netuser_preauthnotrequire_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= @@ -40,7 +40,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_add_self_to_group.yml b/detections/endpoint/windows_ad_add_self_to_group.yml similarity index 90% rename from detections/application/windows_ad_add_self_to_group.yml rename to detections/endpoint/windows_ad_add_self_to_group.yml index 898b7fbfb8..d2a79bb882 100644 --- a/detections/application/windows_ad_add_self_to_group.yml +++ b/detections/endpoint/windows_ad_add_self_to_group.yml @@ -1,6 +1,6 @@ name: Windows AD add Self to Group id: 065f2701-b7ea-42f5-9ec4-fbc2261165f9 -version: 3 +version: 4 date: '2025-01-21' author: Dean Luxton status: production @@ -16,7 +16,7 @@ description: This analytic detects instances where a user adds themselves to an search: '`wineventlog_security` EventCode IN (4728) | where user=src_user | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc - by signature, Group_Name, src_user | `windows_ad_add_self_to_group_filter`' + by signature, Group_Name, src_user, dest | `windows_ad_add_self_to_group_filter`' how_to_implement: This analytic requires eventCode 4728 to be ingested. known_false_positives: Unknown references: [] @@ -56,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 87740e631d..1aa986e497 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,6 +1,6 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 6 +version: 7 date: '2024-11-13' author: Mauricio Velazco, Dean Luxton, Splunk type: TTP @@ -15,35 +15,35 @@ description: The following analytic detects modifications to the Access Control can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment. -search: "`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN=\"CN=AdminSDHolder,CN=System*\"\ - \ | stats min(_time) as _time values(eval(if(OperationType==\"%%14675\",AttributeValue,null))) - as old_value values(eval(if(OperationType==\"%%14674\",AttributeValue,null))) as - new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID - src_user SubjectLogonId | rex field=old_value max_match=10000 \"\\((?P.*?)\\\ - )\" | rex field=new_value max_match=10000 \"\\((?P.*?)\\)\" | mvexpand - new_ace | where NOT new_ace IN (old_values) | rex field=new_ace \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup msad_guid_lookup - guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup - access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string - as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName - as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup - builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name - as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,\"\ - This object only\"), aceAccessRights=if(aceAccessRights=\"CCDCLCSWRPWPDTLOCRSDRCWDWO\"\ - ,\"Full control\",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), +search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | + stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN + OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags + OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup + identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | + lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup builtin_groups_lookup + builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | + eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user - user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights=\"\ - \",\"All rights\",'aceControlAccessRights') | search NOT aceType IN (*denied*,D,OD,XD) - AND aceAccessRights IN (\"Full control\",\"All extended rights\",\"All validated - writes\",\"Create all child objects\",\"Delete all child objects\",\"Delete subtree\"\ - ,\"Delete\",\"Modify permissions\",\"Modify owner\",\"Write all properties\",CC,CR,DC,DT,SD,SW,WD,WO,WP) - | `windows_ad_adminsdholder_acl_modified_filter`" + user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All + rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND + aceAccessRights IN ("Full control","All extended rights","All validated writes","Create + all child objects","Delete all child objects","Delete subtree","Delete","Modify + permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | + `windows_ad_adminsdholder_acl_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created @@ -97,7 +97,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/adminsdholder_modified/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/adminsdholder_modified/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 79de518830..10aae41670 100644 --- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Cross Domain SID History Addition id: 41bbb371-28ba-439c-bb5c-d9930c28365d -version: 7 +version: 8 date: '2025-02-10' author: Dean Luxton type: TTP @@ -20,7 +20,7 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*)(\-|\\\)" | rex field=TargetSid "^(?P.*)(\-|\\\)" | where SidHistoryMatch!=TargetSidmatch AND SidHistoryMatch!=TargetDomainName | rename TargetSid as userSid | table _time - action status host user userSid SidHistory Logon_ID src_user | `windows_ad_cross_domain_sid_history_addition_filter`' + action status host user userSid SidHistory Logon_ID src_user dest | `windows_ad_cross_domain_sid_history_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` within `Account @@ -70,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml similarity index 61% rename from detections/application/windows_ad_dangerous_deny_acl_modification.yml rename to detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml index 4ca51f8ecb..8137dd2fb4 100644 --- a/detections/application/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Dangerous Deny ACL Modification id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7 -version: 4 +version: 5 date: '2025-02-10' author: Dean Luxton status: production @@ -10,33 +10,32 @@ data_source: description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. -search: "`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType==\"\ - %%14675\",AttributeValue,null))) as old_value values(eval(if(OperationType==\"%%14674\"\ - ,AttributeValue,null))) as new_value values(OperationType) as OperationType by ObjectClass - ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 - \"\\((?P.*?)\\)\" | rex field=new_value max_match=10000 \"\\((?P.*?)\\\ - )\" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace - \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup msad_guid_lookup - guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup - access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup - flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution - lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN + OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name - as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,\"\ - This object only\"), aceAccessRights=if(aceAccessRights=\"CCDCLCSWRPWPDTLOCRSDRCWDWO\"\ - ,\"Full control\",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 - AND aceControlAccessRights=\"\",\"All rights\",'aceControlAccessRights') | search - aceType IN (\"Access denied\",D) AND aceAccessRights IN (\"Full control\",\"Read - permissions\",RC) | `windows_ad_dangerous_deny_acl_modification_filter`" + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) + | `windows_ad_dangerous_deny_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes @@ -86,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml similarity index 64% rename from detections/application/windows_ad_dangerous_group_acl_modification.yml rename to detections/endpoint/windows_ad_dangerous_group_acl_modification.yml index b16d8e4701..2c4b8152a2 100644 --- a/detections/application/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Dangerous Group ACL Modification id: 59b0fc85-7a0d-4585-97ec-06a382801990 -version: 4 +version: 5 date: '2025-02-10' author: Dean Luxton status: production @@ -13,38 +13,37 @@ description: 'This detection monitors the addition of the following ACLs to an A permissions", "Modify owner", and "Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' -search: "`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) - as _time values(eval(if(OperationType==\"%%14675\",AttributeValue,null))) as old_value - values(eval(if(OperationType==\"%%14674\",AttributeValue,null))) as new_value values(OperationType) - as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId\ - \ | rex field=old_value max_match=10000 \"\\((?P.*?)\\)\" | rex field=new_value - max_match=10000 \"\\((?P.*?)\\)\" | mvexpand new_ace | where NOT new_ace - IN (old_values) | rex field=new_ace \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup - flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup +search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), - aceInheritance=coalesce(ace_flag_value,\"This object only\"), aceAccessRights=if(aceAccessRights=\"\ - CCDCLCSWRPWPDTLOCRSDRCWDWO\",\"Full control\",coalesce(access_rights_value,AccessRights)), - aceControlAccessRights=if((ControlAccessRights=\"Write member\" OR aceObjectGuid=\"\ - bf9679c0-0de6-11d0-a285-00aa003049e2\") AND (aceAccessRights=\"All validated writes\"\ - \ OR AccessRights=\"SW\"),\"Add/remove self as member\",coalesce(ControlAccessRights,aceObjectGuid)), + aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write + member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All + validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 - AND aceControlAccessRights=\"\",\"All rights\",'aceControlAccessRights') | search - NOT aceType IN (\"*denied*\",\"D\",\"OD\",\"XD\") AND aceAccessRights IN (\"Full - control\",\"All extended rights\",\"All validated writes\",\"Create all child objects\"\ - ,\"Delete all child objects\",\"Delete subtree\",\"Delete\",\"Modify permissions\"\ - ,\"Modify owner\",\"Write all properties\",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`" + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All + extended rights","All validated writes","Create all child objects","Delete all child + objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all + properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes @@ -95,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml similarity index 62% rename from detections/application/windows_ad_dangerous_user_acl_modification.yml rename to detections/endpoint/windows_ad_dangerous_user_acl_modification.yml index b1da8218eb..50a4431520 100644 --- a/detections/application/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Dangerous User ACL Modification id: ec5b6790-595a-4fb8-ad43-56e5b55a9617 -version: 4 +version: 5 date: '2025-02-10' author: Dean Luxton status: production @@ -13,35 +13,35 @@ description: 'This detection monitors the addition of the following ACLs to an A permissions","Modify owner","Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' -search: "`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) - as _time values(eval(if(OperationType==\"%%14675\",AttributeValue,null))) as old_value - values(eval(if(OperationType==\"%%14674\",AttributeValue,null))) as new_value values(OperationType) - as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId\ - \ | rex field=old_value max_match=10000 \"\\((?P.*?)\\)\" | rex field=new_value - max_match=10000 \"\\((?P.*?)\\)\" | mvexpand new_ace | where NOT new_ace - IN (old_values) | rex field=new_ace \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup msad_guid_lookup - guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup - access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup - flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution - lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName +search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name - as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,\"\ - This object only\"), aceAccessRights=if(aceAccessRights=\"CCDCLCSWRPWPDTLOCRSDRCWDWO\"\ - ,\"Full control\",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 - AND aceControlAccessRights=\"\",\"All rights\",'aceControlAccessRights') | search - NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN (\"Full control\",\"All - extended rights\",\"All validated writes\",\"Create all child objects\",\"Delete - all child objects\",\"Delete subtree\",\"Delete\",\"Modify permissions\",\"Modify - owner\",\"Write all properties\",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`" + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended + rights","All validated writes","Create all child objects","Delete all child objects","Delete + subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) + | `windows_ad_dangerous_user_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes @@ -92,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml similarity index 89% rename from detections/application/windows_ad_dcshadow_privileges_acl_addition.yml rename to detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml index f99443215b..2f0dfc601c 100644 --- a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml @@ -1,6 +1,6 @@ name: Windows AD DCShadow Privileges ACL Addition id: ae915743-1aa8-4a94-975c-8062ebc8b723 -version: 4 +version: 5 date: '2025-02-17' author: Dean Luxton status: production @@ -13,10 +13,10 @@ description: This detection identifies an Active Directory access-control list ( search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) - as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | - rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value - max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN - (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid @@ -89,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 3aca3b0ac0..1b5d4510fe 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 8 +version: 9 date: '2024-12-10' author: Dean Luxton type: TTP @@ -39,7 +39,7 @@ search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats mi as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user - user | search (aceControlAccessRights="DS-Replication-Get-Changes" AND aceControlAccessRights="DS-Replication-Get-Changes-All") + user dest | search (aceControlAccessRights="DS-Replication-Get-Changes" AND aceControlAccessRights="DS-Replication-Get-Changes-All") OR (aceControlAccessRights="1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" AND aceControlAccessRights="1131f6ad-9c07-11d1-f79f-00c04fc2dcd2") | `windows_ad_domain_replication_acl_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -100,7 +100,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml similarity index 60% rename from detections/application/windows_ad_domain_root_acl_deletion.yml rename to detections/endpoint/windows_ad_domain_root_acl_deletion.yml index 9650179024..975ecf1e0b 100644 --- a/detections/application/windows_ad_domain_root_acl_deletion.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml @@ -1,6 +1,6 @@ name: Windows AD Domain Root ACL Deletion id: 3cb56e57-5642-4638-907f-8dfde9afb889 -version: 4 +version: 5 date: '2025-02-10' author: Dean Luxton status: production @@ -11,30 +11,30 @@ description: ACL deletion performed on the domain root object, significant AD ch with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. -search: "`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) - as _time values(eval(if(OperationType==\"%%14675\",AttributeValue,null))) as old_value - values(eval(if(OperationType==\"%%14674\",AttributeValue,null))) as new_value values(OperationType) - as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId\ - \ | rex field=old_value max_match=10000 \"\\((?P.*?)\\)\" | rex field=new_value - max_match=10000 \"\\((?P.*?)\\)\" | mvexpand old_values | where NOT - old_values IN (new_values) | rex field=old_values \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup msad_guid_lookup - guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup - access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string - as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName - as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | - lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name - as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,\"\ - This object only\"), aceAccessRights=if(aceAccessRights=\"CCDCLCSWRPWPDTLOCRSDRCWDWO\"\ - ,\"Full control\",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | + where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags + OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup + identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | + lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup + builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval + aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 - AND aceControlAccessRights=\"\",\"All rights\",'aceControlAccessRights') | `windows_ad_domain_root_acl_deletion_filter`" + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes @@ -85,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/endpoint/windows_ad_domain_root_acl_modification.yml similarity index 57% rename from detections/application/windows_ad_domain_root_acl_modification.yml rename to detections/endpoint/windows_ad_domain_root_acl_modification.yml index 93713d4782..0fa0eea7ff 100644 --- a/detections/application/windows_ad_domain_root_acl_modification.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Domain Root ACL Modification id: 4981e2db-1372-440d-816e-3e7e2ed74433 -version: 4 +version: 5 date: '2025-02-10' author: Dean Luxton status: production @@ -11,30 +11,29 @@ description: ACL modification performed on the domain root object, significant A change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. -search: "`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) - as _time values(eval(if(OperationType==\"%%14675\",AttributeValue,null))) as old_value - values(eval(if(OperationType==\"%%14674\",AttributeValue,null))) as new_value values(OperationType) - as OperationType by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId\ - \ | rex field=old_value max_match=10000 \"\\((?P.*?)\\)\" | rex field=new_value - max_match=10000 \"\\((?P.*?)\\)\" | mvexpand new_ace | where NOT new_ace - IN (old_values) | rex field=new_ace \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup msad_guid_lookup - guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup - access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string - as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName - as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | - lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name - as builtin_group | eval aceAccessRights=if(aceAccessRights=\"CCDCLCSWRPWPDTLOCRSDRCWDWO\"\ - ,\"Full control\",'access_rights_value'), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,\"\ - This object only\"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, - group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) - as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) + as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value + values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) + as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user + SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags + OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup + identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | + lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup + builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval + aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), + aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, + user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType + values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 - AND aceControlAccessRights=\"\",\"All rights\",'aceControlAccessRights') | `windows_ad_domain_root_acl_modification_filter`" + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes @@ -85,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_dsrm_account_changes.yml b/detections/endpoint/windows_ad_dsrm_account_changes.yml index 47a929e7b3..172a75fe1a 100644 --- a/detections/endpoint/windows_ad_dsrm_account_changes.yml +++ b/detections/endpoint/windows_ad_dsrm_account_changes.yml @@ -1,13 +1,13 @@ name: Windows AD DSRM Account Changes id: 08cb291e-ea77-48e8-a95a-0799319bf056 -version: 5 +version: 6 date: '2024-11-13' author: Dean Luxton type: TTP status: production data_source: -- Sysmon EventID 1 AND Sysmon EventID 12 -- Sysmon EventID 1 AND Sysmon EventID 13 +- Sysmon EventID 12 +- Sysmon EventID 13 description: The following analytic identifies changes to the Directory Services Restore Mode (DSRM) account behavior via registry modifications. It detects alterations in the registry path "*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior" @@ -16,16 +16,13 @@ description: The following analytic identifies changes to the Directory Services similar to a local administrator account. If confirmed malicious, an attacker could gain persistent administrative access to a Domain Controller, leading to potential domain-wide compromise and unauthorized access to sensitive information. -search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry - where Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior" - Registry.registry_value_data IN ("*1","*2") by Registry.action Registry.registry_path - Registry.registry_value_data Registry.registry_value_type Registry.process_guid - Registry.dest Registry.user | `drop_dm_object_name(Registry)` | join type=outer - process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by Processes.user Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`] - | table _time action dest user parent_process_name parent_process process_name process - process_guid registry_path registry_value_data registry_value_type | `windows_ad_dsrm_account_changes_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior" + Registry.registry_value_data IN ("*1","*2") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ad_dsrm_account_changes_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_gpo_deleted.yml b/detections/endpoint/windows_ad_gpo_deleted.yml similarity index 70% rename from detections/application/windows_ad_gpo_deleted.yml rename to detections/endpoint/windows_ad_gpo_deleted.yml index f55edba197..18cd993086 100644 --- a/detections/application/windows_ad_gpo_deleted.yml +++ b/detections/endpoint/windows_ad_gpo_deleted.yml @@ -1,6 +1,6 @@ name: Windows AD GPO Deleted id: 0d41772b-35ab-4e1c-a2ba-d0b455481aee -version: 4 +version: 5 date: '2025-02-17' author: Dean Luxton status: production @@ -12,15 +12,16 @@ description: This detection identifies when an Active Directory Group Policy is search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink | eval ObjectDN=upper(ObjectDN) | stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value - values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID - ObjectDN SubjectLogonId | rex field=old_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" - | rex field=new_value max_match=10000 "(?i)LDAP://(?Pcn.*?);(?P\d)\]" - | mvexpand old_dn | where NOT old_dn IN (new_dn) | eval ObjectDN=upper(old_dn) | - join ObjectDN type=outer [| search `admon` objectCategory="CN=Group-Policy-Container*" - admonEventType=Update | eval ObjectDN=upper(distinguishedName) | stats latest(displayName) - as displayName by ObjectDN ] | stats min(eventTime) as _time values(OpCorrelationID) - as OpCorrelationID values(displayName) as policyName values(src_user) as src_user - by ObjectDN SubjectLogonId | `windows_ad_gpo_deleted_filter`' + values(OperationType) as OperationType values(src_user) as src_user values(dest) + as dest by OpCorrelationID ObjectDN SubjectLogonId | rex field=old_value max_match=10000 + "(?i)LDAP://(?Pcn.*?);(?P\d)\]" | rex field=new_value max_match=10000 + "(?i)LDAP://(?Pcn.*?);(?P\d)\]" | mvexpand old_dn | where NOT + old_dn IN (new_dn) | eval ObjectDN=upper(old_dn) | join ObjectDN type=outer [| search + `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update | eval + ObjectDN=upper(distinguishedName) | stats latest(displayName) as displayName by + ObjectDN ] | stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID + values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId + | `windows_ad_gpo_deleted_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure @@ -64,11 +65,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-admon.log source: ActiveDirectory sourcetype: ActiveDirectory diff --git a/detections/application/windows_ad_gpo_disabled.yml b/detections/endpoint/windows_ad_gpo_disabled.yml similarity index 89% rename from detections/application/windows_ad_gpo_disabled.yml rename to detections/endpoint/windows_ad_gpo_disabled.yml index a661dafbe6..4e19e9e2fe 100644 --- a/detections/application/windows_ad_gpo_disabled.yml +++ b/detections/endpoint/windows_ad_gpo_disabled.yml @@ -1,6 +1,6 @@ name: Windows AD GPO Disabled id: 72793bc0-c0cd-400e-9e60-fdf36f278917 -version: 4 +version: 5 date: '2025-02-17' author: Dean Luxton status: production @@ -18,7 +18,7 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags Op by ObjectDN ] | stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId - | `windows_ad_gpo_disabled_filter`' + dest | `windows_ad_gpo_disabled_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure @@ -62,11 +62,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_disabled/windows-admon.log source: ActiveDirectory sourcetype: ActiveDirectory diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml similarity index 86% rename from detections/application/windows_ad_gpo_new_cse_addition.yml rename to detections/endpoint/windows_ad_gpo_new_cse_addition.yml index fa51530e81..3d3c84a333 100644 --- a/detections/application/windows_ad_gpo_new_cse_addition.yml +++ b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml @@ -1,6 +1,6 @@ name: Windows AD GPO New CSE Addition id: 700c11d1-da09-47b2-81aa-358c143c7986 -version: 4 +version: 5 date: '2025-02-10' author: Dean Luxton status: production @@ -12,9 +12,9 @@ description: This detection identifies when a a new client side extension is add search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer AttributeLDAPDisplayName=gPCMachineExtensionNames | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value - values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user - SubjectLogonId | rex field=old_value max_match=10000 "(?P\{.*?\})" | - rex field=new_value max_match=10000 "(?P\{.*?\})" | rex field=ObjectDN + values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN + OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "(?P\{.*?\})" + | rex field=new_value max_match=10000 "(?P\{.*?\})" | rex field=ObjectDN max_match=10000 "CN=(?P\{.*?\})" | mvexpand new_values | where NOT new_values IN (old_values,"{00000000-0000-0000-0000-000000000000}",policy_guid) AND match(new_values, "^\{[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\-[A-Z|\d]+\}") @@ -74,11 +74,9 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-admon.log source: ActiveDirectory sourcetype: ActiveDirectory diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/endpoint/windows_ad_hidden_ou_creation.yml similarity index 61% rename from detections/application/windows_ad_hidden_ou_creation.yml rename to detections/endpoint/windows_ad_hidden_ou_creation.yml index 53fb735b3e..a1c09abd68 100644 --- a/detections/application/windows_ad_hidden_ou_creation.yml +++ b/detections/endpoint/windows_ad_hidden_ou_creation.yml @@ -1,6 +1,6 @@ name: Windows AD Hidden OU Creation id: 66b6ad5e-339a-40af-b721-dacefc7bdb75 -version: 4 +version: 5 date: '2025-02-10' author: Dean Luxton status: production @@ -10,33 +10,33 @@ data_source: description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. -search: "`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats - min(_time) as _time values(eval(if(OperationType==\"%%14675\",AttributeValue,null))) - as old_value values(eval(if(OperationType==\"%%14674\",AttributeValue,null))) as - new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID - src_user SubjectLogonId | rex field=old_value max_match=10000 \"\\((?P.*?)\\\ - )\" | rex field=new_value max_match=10000 \"\\((?P.*?)\\)\" | mvexpand - new_ace | where NOT new_ace IN (old_values) | rex field=new_ace \"(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$\"\ - \ | rex max_match=100 field=aceAccessRights \"(?P[A-Z]{2})\" | rex - max_match=100 field=aceFlags \"(?P[A-Z]{2})\" | lookup msad_guid_lookup - guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup - access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup - ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup - flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution - lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName +search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats + min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value + values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN + OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | + rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | + where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | + rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid + OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string + as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name - as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,\"\ - This object only\"), aceAccessRights=if(aceAccessRights=\"CCDCLCSWRPWPDTLOCRSDRCWDWO\"\ - ,\"Full control\",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), + as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 - AND aceControlAccessRights=\"\",\"All rights\",'aceControlAccessRights') | search - aceType IN (\"Access denied\",D) AND aceAccessRights IN (\"List contents\",\"List - objects\",LC,LO) | `windows_ad_hidden_ou_creation_filter`" + AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search + aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) + | `windows_ad_hidden_ou_creation_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes @@ -84,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/endpoint/windows_ad_object_owner_updated.yml similarity index 75% rename from detections/application/windows_ad_object_owner_updated.yml rename to detections/endpoint/windows_ad_object_owner_updated.yml index 3f41be4cf1..a9d80aa33b 100644 --- a/detections/application/windows_ad_object_owner_updated.yml +++ b/detections/endpoint/windows_ad_object_owner_updated.yml @@ -1,6 +1,6 @@ name: Windows AD Object Owner Updated id: 4af01f6b-d8d4-4f96-8635-758a01557130 -version: 5 +version: 6 date: '2025-02-10' author: Dean Luxton status: production @@ -12,16 +12,16 @@ description: AD Object Owner Updated. The owner provides Full control level priv precursor activity for hiding an AD object. search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value - values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID src_user - SubjectLogonId DSName | rex field=old_value "O:(?P.*?)G:" | rex field=new_value - "O:(?P.*?)G:" | where old_owner!=new_owner ``` optional SID resolution - lookups | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName - as new_owner_user | lookup admon_groups_def objectSid as new_owner OUTPUT cn as - new_owner_group | lookup identity_lookup_expanded objectSid as old_owner OUTPUT - downLevelDomainName as old_owner_user | lookup admon_groups_def objectSid as old_owner - OUTPUT cn as old_owner_group ``` | lookup builtin_groups_lookup builtin_group_string as - new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group | lookup - builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name + values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN + OpCorrelationID src_user SubjectLogonId DSName | rex field=old_value "O:(?P.*?)G:" + | rex field=new_value "O:(?P.*?)G:" | where old_owner!=new_owner ``` + optional SID resolution lookups | lookup identity_lookup_expanded objectSid as new_owner + OUTPUT downLevelDomainName as new_owner_user | lookup admon_groups_def objectSid + as new_owner OUTPUT cn as new_owner_group | lookup identity_lookup_expanded objectSid + as old_owner OUTPUT downLevelDomainName as old_owner_user | lookup admon_groups_def + objectSid as old_owner OUTPUT cn as old_owner_group ``` | lookup builtin_groups_lookup + builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) @@ -76,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index c41aece18f..e1007c4097 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 -version: 7 +version: 8 date: '2025-02-10' author: Dean Luxton type: TTP @@ -19,7 +19,8 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" | eval category="privileged" | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match | where isnotnull(match) | rename TargetSid as userSid - | table _time action status host user userSid SidHistory Logon_ID src_user | `windows_ad_privileged_account_sid_history_addition_filter`' + | table _time action status host user userSid SidHistory Logon_ID src_user dest + | `windows_ad_privileged_account_sid_history_addition_filter`' how_to_implement: Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName` added to the identity field of your Asset and Identities lookup, along with the category of privileged for the applicable users. Ensure you are ingesting eventcodes @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_privileged_group_modification.yml b/detections/endpoint/windows_ad_privileged_group_modification.yml similarity index 100% rename from detections/application/windows_ad_privileged_group_modification.yml rename to detections/endpoint/windows_ad_privileged_group_modification.yml diff --git a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml index 46eb38dc10..c47b90a791 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml @@ -1,7 +1,7 @@ name: Windows AD Replication Request Initiated by User Account id: 51307514-1236-49f6-8686-d46d93cc2821 -version: 8 -date: '2025-02-10' +version: 9 +date: '2025-03-27' author: Dean Luxton type: TTP status: production @@ -14,18 +14,23 @@ description: The following analytic detects a user account initiating an Active sufficient privileges to request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of the entire domain. -search: >- - `wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}","domainDNS") - AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*","*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") - AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") - | stats min(_time) as _time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status - | rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time - | appendpipe - [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$" | fields - status] - | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, ObjectServer, ObjectType, OperationType - | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as - src_category, values(src_ip) as src_ip by TargetLogonId - | `windows_ad_replication_request_initiated_by_user_account_filter` +search: "`wineventlog_security` EventCode=4662 ObjectType IN (\"%{19195a5b-6da0-11d0-afd3-00c04fd930c9}\"\ + ,\"domainDNS\") \n AND Properties IN (\"*Replicating Directory Changes All*\"\ + , \"*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*\",\"*{9923a32a-3607-11d2-b9be-0000f87a36b2}*\"\ + ,\"*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*\")\n AND AccessMask=\"0x100\" AND\ + \ NOT (SubjectUserSid=\"NT AUT*\" OR SubjectUserSid=\"S-1-5-18\" OR SubjectDomainName=\"\ + Window Manager\" OR SubjectUserName=\"*$\") \n| stats min(_time) as _time, count\ + \ by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer,\ + \ ObjectType, OperationType, status dest | rename SubjectDomainName as Target_Domain,\ + \ SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time | appendpipe\ + \ \n [| map search=\"search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$\"\ + \ | fields - status] \n| table attack_time, AuthenticationPackageName, LogonProcessName,\ + \ LogonType, TargetUserSid, Target_Domain, user, Computer, TargetLogonId, status,\ + \ src_ip, src_category, ObjectName, ObjectServer, ObjectType, OperationType, dest\ + \ | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain)\ + \ as Target_Domain, values(user) as user, values(Computer) as Computer, values(status)\ + \ as status, values(src_category) as\n src_category, values(src_ip) as src_ip\ + \ by TargetLogonId dest\n| `windows_ad_replication_request_initiated_by_user_account_filter`" how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services Access` within `DS Access` needs to be enabled, as well as the following SACLs applied @@ -33,7 +38,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin Computers`, and `Domain Controllers` auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and `Replicating Directory Changes In Filtered Set` -known_false_positives: Azure AD Connect syncing operations and the dcdiag.exe /Test:Replications command. +known_false_positives: Azure AD Connect syncing operations and the dcdiag.exe /Test:Replications + command. references: - https://adsecurity.org/?p=1729 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer @@ -79,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/mimikatz/xml-windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/mimikatz/xml-windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index 90f6777df0..93371cf3da 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -1,7 +1,7 @@ name: Windows AD Replication Request Initiated from Unsanctioned Location id: 50998483-bb15-457b-a870-965080d9e3d3 -version: 9 -date: '2025-02-10' +version: 10 +date: '2025-03-27' author: Dean Luxton type: TTP status: production @@ -21,13 +21,15 @@ search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-1 "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") | stats min(_time) - as attack_time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, - ObjectName, ObjectServer, ObjectType, OperationType, status | rename SubjectDomainName - as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId | appendpipe - [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] - | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, - Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, - ObjectServer, ObjectType, OperationType | stats min(attack_time) as _time, values(TargetUserSid) + as attack_time, count by SubjectDomainName SubjectUserName Computer Logon_ID ObjectName + ObjectServer ObjectType OperationType status action app authentication_method dest + dvc process process_id process_name process_path signature signature_id src src_port + status subject user user_group vendor_product | rename SubjectDomainName as Target_Domain, + SubjectUserName as user, Logon_ID as TargetLogonId | appendpipe [| map search="search + `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] | table attack_time, + AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain, + user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, ObjectServer, + ObjectType, OperationType | stats min(attack_time) as _time, values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId | search NOT src_category="domain_controller" @@ -88,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml index 06ebf8cd4c..3377cde418 100644 --- a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Same Domain SID History Addition id: 5fde0b7c-df7a-40b1-9b3a-294c00f0289d -version: 7 +version: 8 date: '2025-02-10' author: Dean Luxton type: TTP @@ -20,7 +20,7 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | rex field=TargetSid "^(?P.*)(\-|\\\)" | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory - Logon_ID src_user | `windows_ad_same_domain_sid_history_addition_filter`' + Logon_ID src_user dest | `windows_ad_same_domain_sid_history_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` within `Account @@ -71,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_self_dacl_assignment.yml b/detections/endpoint/windows_ad_self_dacl_assignment.yml new file mode 100644 index 0000000000..03193bbd54 --- /dev/null +++ b/detections/endpoint/windows_ad_self_dacl_assignment.yml @@ -0,0 +1,81 @@ +name: Windows AD Self DACL Assignment +id: 16132445-da9f-4d03-ad44-56d717dcd67d +version: 5 +date: '2025-02-17' +author: Dean Luxton +status: production +type: TTP +data_source: +- Windows Event Log Security 5136 +description: Detect when a user creates a new DACL in AD for their own AD object. +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) + as old_value values(eval(if(OperationType=="%%14674" ,AttributeValue,null))) as + new_value values(OperationType) as OperationType by ObjectClass ObjectDN OpCorrelationID + src_user SubjectLogonId dest | rex field=old_value max_match=10000 "\((?P.*?)\)" + | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace + | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" + | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 + field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string + as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string + as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup + access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup + guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup builtin_groups_lookup + builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval + aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This + object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full + control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write + member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All + validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)),user=coalesce(user, + group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) + as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) + as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid + by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID dest + | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All + rights","aceControlAccessRights") | `windows_ad_self_dacl_assignment_filter`' +how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically + event 5136. See lantern article in references for further on how to onboard AD audit + data. Ensure the wineventlog_security macro is configured with the correct indexes + and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. +known_false_positives: Unknown +references: +- https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: $user$ has created a DACL on $ObjectDN$ to grant themselves $aceControlAccessRights$ + across $aceAccessRights$ + risk_objects: + - field: user + type: user + score: 80 + threat_objects: [] +tags: + analytic_story: + - Sneaky Active Directory Persistence Tricks + asset_type: Endpoint + mitre_attack_id: + - T1484 + - T1098 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml index ab66bb479f..1494a1eb86 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml @@ -1,6 +1,6 @@ name: Windows AD Short Lived Domain Account ServicePrincipalName id: b681977c-d90c-4efc-81a5-c58f945fb541 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk type: TTP @@ -18,7 +18,8 @@ description: The following analytic identifies the addition and quick deletion o search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName | transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674") endswith=(EventCode=5136 OperationType="%%14675") | eval short_lived=case((duration<300),"TRUE") - | search short_lived = TRUE | rename ObjectDN as user | `windows_ad_short_lived_domain_account_serviceprincipalname_filter`' + | search short_lived = TRUE | rename ObjectDN as user | rename Computer as dest + | `windows_ad_short_lived_domain_account_serviceprincipalname_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml index 35c57cdcaa..7335163c57 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml @@ -1,6 +1,6 @@ name: Windows AD Short Lived Domain Controller SPN Attribute id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 -version: 7 +version: 8 date: '2024-12-10' author: Dean Luxton type: TTP @@ -21,12 +21,13 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP | stats min(_time) as _time range(_time) as duration values(OperationType) as OperationType values(user) as user values(src_ip) as src_ip values(src_nt_domain) as src_nt_domain values(src_user) as src_user values(Computer) as dest, values(ObjectDN) as ObjectDN - by Logon_ID | eval short_lived=case((duration<30),"TRUE") | where short_lived="TRUE" + values(action) as action values(app) as app values(authentication_method) as authentication_method + values(signature) as signature values(signature_id) as signature_id values(src) + as src by Logon_ID | eval short_lived=case((duration<30),"TRUE") | where short_lived="TRUE" AND mvcount(OperationType)>1 | replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType | rename Logon_ID as TargetLogonId | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] - | stats min(_time) as _time, values(ObjectDN) as ObjectDN values(OperationType) - as OperationType by TargetLogonId src_user dest | `windows_ad_short_lived_domain_controller_spn_attribute_filter`' + | `windows_ad_short_lived_domain_controller_spn_attribute_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` @@ -74,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml index e6e6c0b674..1dae156a44 100644 --- a/detections/endpoint/windows_ad_short_lived_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_server_object.yml @@ -1,6 +1,6 @@ name: Windows AD Short Lived Server Object id: 193769d3-1e33-43a9-970e-ad4a88256cdb -version: 6 +version: 7 date: '2024-12-10' author: Mauricio Velazco, Splunk type: TTP @@ -19,7 +19,8 @@ description: The following analytic identifies the creation and quick deletion o search: '`wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration*" | transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141) | eval short_lived=case((duration<30),"TRUE") | search short_lived = TRUE | stats values(ObjectDN) - values(signature) values(EventCode) by _time, Computer, SubjectUserName | `windows_ad_short_lived_server_object_filter`' + values(signature) values(EventCode) by _time, Computer, SubjectUserName, dest | + `windows_ad_short_lived_server_object_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting Event codes `5137` and `5141`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. For these event codes @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/short_lived_server_object/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/short_lived_server_object/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/endpoint/windows_ad_suspicious_attribute_modification.yml similarity index 100% rename from detections/application/windows_ad_suspicious_attribute_modification.yml rename to detections/endpoint/windows_ad_suspicious_attribute_modification.yml diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/endpoint/windows_ad_suspicious_gpo_modification.yml similarity index 100% rename from detections/application/windows_ad_suspicious_gpo_modification.yml rename to detections/endpoint/windows_ad_suspicious_gpo_modification.yml diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index fc0560f8f3..c78db66802 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -1,6 +1,6 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f -version: 7 +version: 8 date: '2024-11-13' author: Jose Hernandez, Bhavin Patel, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*-gcb *" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*")) - by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`| - `windows_adfind_exe_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_adfind_exe_filter`| `windows_adfind_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -89,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml index dd928372f2..3d8dd32080 100644 --- a/detections/endpoint/windows_admin_permission_discovery.yml +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -1,6 +1,6 @@ name: Windows Admin Permission Discovery id: e08620cb-9488-4052-832d-97bcc0afd414 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,13 +17,14 @@ description: The following analytic identifies the creation of a suspicious file search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.bat", "*.cmd", "*.pif", - "*.lnk", "*.dat") by Filesystem.dest Filesystem.file_create_time Filesystem.process_id - Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.user - | `drop_dm_object_name(Filesystem)` | eval dropped_file_path = split(file_path, - "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) | eval root_drive - = mvindex(dropped_file_path,0) | where LIKE(root_drive, "C:") AND dropped_file_path_split_count - = 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | - `windows_admin_permission_discovery_filter`' + "*.lnk", "*.dat") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count + = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | + where LIKE(root_drive, "C:") AND dropped_file_path_split_count = 2 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_admin_permission_discovery_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml index dd898f8ddf..7d73d70f51 100644 --- a/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml +++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml @@ -1,6 +1,6 @@ name: Windows Administrative Shares Accessed On Multiple Hosts id: d92f2d95-05fb-48a7-910f-4d3d61ab8655 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk type: TTP @@ -18,8 +18,8 @@ description: The following analytic detects a source computer accessing Windows search: '`wineventlog_security` EventCode=5140 OR EventCode=5145 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets values(ShareName) - as shares by _time, IpAddress, SubjectUserName, EventCode | where unique_targets - > 30 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`' + as shares values(dest) as dest by _time, IpAddress, SubjectUserName, EventCode | + where unique_targets > 30 | `windows_administrative_shares_accessed_on_multiple_hosts_filter`' how_to_implement: To successfully implement this search, you need to be ingesting file share events. The Advanced Security Audit policy setting `Audit Detailed File Share` or `Audit File Share` within `Object Access` need to be enabled. @@ -72,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_alternate_datastream___base64_content.yml b/detections/endpoint/windows_alternate_datastream___base64_content.yml index ecd4e049de..1758727515 100644 --- a/detections/endpoint/windows_alternate_datastream___base64_content.yml +++ b/detections/endpoint/windows_alternate_datastream___base64_content.yml @@ -1,6 +1,6 @@ name: Windows Alternate DataStream - Base64 Content id: 683f48de-982f-4a7e-9aac-9cec550da498 -version: 6 +version: 7 date: '2025-02-10' author: Steven Dick, Teoderick Contreras, Michael Haag, Splunk status: production @@ -19,8 +19,9 @@ search: '`sysmon` EventCode=15 NOT Contents IN ("-","[ZoneTransfer]*") | regex T | regex Contents="(?:[A-Za-z0-9+/]{128,})(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" | eval file_name = replace(TargetFilename,"(.*\\\)",""), process = Image , file_path = TargetFilename , base64 = Contents, file_hash = coalesce(SHA256,SHA1,MD5,Hash) - | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user - by dest, process, process_guid, file_name, file_path, file_hash, base64 | `base64decode(base64)` + | stats count min(_time) as firstTime max(_time) as lastTime by dest dvc file_hash + file_name file_path process process_exec process_guid process_id process_name process_path + signature signature_id user_id vendor_product Contents Image base64 | `base64decode(base64)` | fields - base64 | rename base64_decode as command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_alternate_datastream___base64_content_filter`' how_to_implement: Target environment must ingest sysmon data, specifically Event ID @@ -33,29 +34,26 @@ references: - https://blog.netwrix.com/2022/12/16/alternate_data_stream/ - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/file-stream-creation-hash.md drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Base64 content written to an NTFS alternate data stream by $user$, see + message: Base64 content written to an NTFS alternate data stream in $dest$, see command field for details. risk_objects: - field: dest type: system score: 80 - - field: user - type: user - score: 80 threat_objects: - field: file_name type: file_name @@ -73,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml index b60c3f31df..cda4b2b06f 100644 --- a/detections/endpoint/windows_alternate_datastream___executable_content.yml +++ b/detections/endpoint/windows_alternate_datastream___executable_content.yml @@ -1,6 +1,6 @@ name: Windows Alternate DataStream - Executable Content id: a258bf2a-34fd-4986-8086-78f506e00206 -version: 7 +version: 8 date: '2025-02-10' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -17,9 +17,10 @@ data_source: search: '`sysmon` EventCode=15 IMPHASH!=00000000000000000000000000000000 | regex TargetFilename="(?.*$)" - | rex field=file_name_association "\.(?[^\.]*$)" | where isnull(extension) - and isnotnull(file_name_association) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_change_default_file_association_for_no_file_ext_filter`' + AND Processes.process= *Notepad.exe* by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | rex field=process "Notepad\.exe (?.*$)" | rex field=file_name_association + "\.(?[^\.]*$)" | where isnull(extension) and isnotnull(file_name_association) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_change_default_file_association_for_no_file_ext_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml b/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml index c89ebdfcec..8f4a0ad61f 100644 --- a/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml +++ b/detections/endpoint/windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml @@ -1,18 +1,43 @@ name: Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc id: 44badcb1-2e8c-4628-9537-021bbae571ad -version: 1 +version: 2 date: '2025-02-19' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the use of the `sfc.exe` utility, in order to stop the Immunet Protect service. The Sfc.exe utility is part of Cisco Secure Endpoint installation. This detection leverages telemetry from the endpoint, focusing on command-line executions involving the `-k` parameter. This activity is significant as it indicates potential tampering with defensive mechanisms. If confirmed malicious, attackers could partially blind the EDR, enabling further compromise and lateral movement within the network. +description: The following analytic detects the use of the `sfc.exe` utility, in order + to stop the Immunet Protect service. The Sfc.exe utility is part of Cisco Secure + Endpoint installation. This detection leverages telemetry from the endpoint, focusing + on command-line executions involving the `-k` parameter. This activity is significant + as it indicates potential tampering with defensive mechanisms. If confirmed malicious, + attackers could partially blind the EDR, enabling further compromise and lateral + movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -k*" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_stop_immunet_service_via_sfc_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" + Processes.process="* -k*" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_cisco_secure_endpoint_stop_immunet_service_via_sfc_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: It is possible that this action is executed during troubleshooting + activity. Activity needs to be confirmed on a case by case basis. references: - https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html drilldown_searches: @@ -21,11 +46,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious use of `sfc.exe` stopping the Immunet Protect service on $dest$ by user $user$. + message: Suspicious use of `sfc.exe` stopping the Immunet Protect service on $dest$ + by user $user$. risk_objects: - field: user type: user diff --git a/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml b/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml index ee9f8746c9..285dbb9058 100644 --- a/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml +++ b/detections/endpoint/windows_cisco_secure_endpoint_unblock_file_via_sfc.yml @@ -1,18 +1,44 @@ name: Windows Cisco Secure Endpoint Unblock File Via Sfc id: 9a7a490c-5581-4c95-bab5-a21e351293ef -version: 1 +version: 2 date: '2025-02-19' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the use of the sfc.exe utility with the "-unblock" parameter, a feature within Cisco Secure Endpoint. The "-unblock" flag is used to remove system blocks imposed by the endpoint protection. This detection focuses on command-line activity that includes the "-unblock" parameter, as it may indicate an attempt to restore access to files or processes previously blocked by the security software. While this action could be legitimate in troubleshooting scenarios, malicious actors might use it to override protective measures, enabling execution of blocked malicious payloads or bypassing other security mechanisms. +description: The following analytic detects the use of the sfc.exe utility with the + "-unblock" parameter, a feature within Cisco Secure Endpoint. The "-unblock" flag + is used to remove system blocks imposed by the endpoint protection. This detection + focuses on command-line activity that includes the "-unblock" parameter, as it may + indicate an attempt to restore access to files or processes previously blocked by + the security software. While this action could be legitimate in troubleshooting + scenarios, malicious actors might use it to override protective measures, enabling + execution of blocked malicious payloads or bypassing other security mechanisms. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_unblock_file_via_sfc_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" + Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_cisco_secure_endpoint_unblock_file_via_sfc_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: It is possible that this action is executed during troubleshooting + activity. Activity needs to be confirmed on a case by case basis. references: - https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html drilldown_searches: @@ -21,11 +47,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious use of `sfc.exe` unblocking a potentially harmful file on $dest$ by user $user$ + message: Suspicious use of `sfc.exe` unblocking a potentially harmful file on $dest$ + by user $user$ risk_objects: - field: user type: user @@ -41,7 +73,7 @@ rba: tags: analytic_story: - Security Solution Tampering - asset_type: Endpoint + asset_type: Endpoint mitre_attack_id: - T1562.001 product: diff --git a/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml b/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml index c05cf68fc3..f36d206b8a 100644 --- a/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml +++ b/detections/endpoint/windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml @@ -1,18 +1,44 @@ name: Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc id: ba6e7f4d-a85e-4a14-8e7d-41f4b82e3c9a -version: 1 +version: 2 date: '2025-02-19' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the use of the sfc.exe utility with the "-u" parameter, which is part of the Cisco Secure Endpoint installation. The "-u" flag allows the uninstallation of Cisco Secure Endpoint components. This detection leverages endpoint telemetry to monitor command-line executions that include the "-u" parameter. The use of this flag is significant as it could indicate an attempt to disable or remove endpoint protection, potentially leaving the system vulnerable to further exploitation. If identified as malicious, this action may be part of a broader effort to disable security mechanisms and avoid detection. +description: The following analytic detects the use of the sfc.exe utility with the + "-u" parameter, which is part of the Cisco Secure Endpoint installation. The "-u" + flag allows the uninstallation of Cisco Secure Endpoint components. This detection + leverages endpoint telemetry to monitor command-line executions that include the + "-u" parameter. The use of this flag is significant as it could indicate an attempt + to disable or remove endpoint protection, potentially leaving the system vulnerable + to further exploitation. If identified as malicious, this action may be part of + a broader effort to disable security mechanisms and avoid detection. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -u*" NOT Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: It is possible that this action is executed during troubleshooting activity. Activity needs to be confirmed on a case by case basis. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" + Processes.process="* -u*" NOT Processes.process="* -unblock *" AND NOT Processes.process_path + IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: It is possible that this action is executed during troubleshooting + activity. Activity needs to be confirmed on a case by case basis. references: - https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html drilldown_searches: @@ -21,11 +47,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious use of `sfc.exe` to uninstall the Immunet Protect service on $dest$ by user $user$. + message: Suspicious use of `sfc.exe` to uninstall the Immunet Protect service on + $dest$ by user $user$. risk_objects: - field: user type: user diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml index e66040efb9..9aaa2e7003 100644 --- a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml +++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml @@ -1,6 +1,6 @@ name: Windows ClipBoard Data via Get-ClipBoard id: ab73289e-2246-4de0-a14b-67006c72a893 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -14,10 +14,10 @@ description: The following analytic detects the execution of the PowerShell comm information, potentially compromising user accounts and other critical assets. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-Clipboard*" | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer - UserID | rename Computer as dest | rename UserID as user| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_clipboard_data_via_get_clipboard_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-Clipboard*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_clipboard_data_via_get_clipboard_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -27,13 +27,13 @@ references: - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -47,7 +47,7 @@ rba: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/powershell/windows-powershell-xml2.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index ea35cf83bc..ea12b3fe72 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -1,6 +1,6 @@ name: Windows Cmdline Tool Execution From Non-Shell Process id: 2afa393f-b88d-41b7-9793-623c93a2dfde -version: 3 +version: 4 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", - "powershell_ise.exe", "pwsh.exe", "explorer.exe", "-", "unknown") by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id - Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' + "powershell_ise.exe", "pwsh.exe", "explorer.exe", "-", "unknown") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_cmdline_tool_execution_from_non_shell_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -91,7 +95,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml index 0e083199b3..c82ec4038a 100644 --- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml @@ -1,6 +1,6 @@ name: Windows COM Hijacking InprocServer32 Modification id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` Processes.process=*inprocserver32* - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_com_hijacking_inprocserver32_modification_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_com_hijacking_inprocserver32_modification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index f53e86e200..1dece3a4ec 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -1,6 +1,6 @@ name: Windows Command and Scripting Interpreter Hunting Path Traversal id: d0026380-b3c4-4da0-ac8e-02790063ff6b -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Michael Haag, Splunk status: production @@ -18,12 +18,15 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes by Processes.original_file_name Processes.process_id - Processes.parent_process_id Processes.process_hash Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval - count_of_pattern1 = (mvcount(split(process,"/.."))-1) | eval count_of_pattern2 = - (mvcount(split(process,"\.."))-1) | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) + as lastTime FROM datamodel=Endpoint.Processes by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) | eval count_of_pattern2 + = (mvcount(split(process,"\.."))-1) | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) | search count_of_pattern1 > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' @@ -55,7 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 77ea2d9bcd..2a0691eee7 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -1,7 +1,7 @@ name: Windows Command and Scripting Interpreter Path Traversal Exec id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 -version: 7 -date: '2025-03-03' +version: 8 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where NOT Processes.os="Linux" Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id - Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 106511a1d6..64bc5bafcc 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -1,6 +1,6 @@ name: Windows Command Shell DCRat ForkBomb Payload id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1 -version: 7 +version: 8 date: '2025-02-19' author: Teoderick Contreras, Splunk status: production @@ -16,15 +16,21 @@ description: The following analytic detects the execution of a DCRat "forkbomb" data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.parent_process) as parent_process values(Processes.parent_process_id) - as parent_process_id values(Processes.process_id) as process_id dc(Processes.parent_process_id) +search: '| tstats `security_content_summariesonly` values(Processes.user) as user + values(Processes.action) as action values(Processes.parent_process_exec) as parent_process_exec + values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) + as parent_process_id values(Processes.parent_process_path) as parent_process_path + values(Processes.process) as process values(Processes.process_exec) as process_exec + values(Processes.process_guid) as process_guid values(Processes.process_hash) as + process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) + as user_id values(Processes.vendor_product) as vendor_product dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" OR Processes.original_file_name= - "notepad.exe") Processes.parent_process = "*.bat*" by Processes.parent_process_name + "notepad.exe") Processes.parent_process = "*.bat*" by Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.parent_process Processes.dest - Processes.user _time span=30s | where parent_process_id_count>= 10 AND process_id_count + Processes.user _time span=30s | where parent_process_id_count>= 10 AND process_id_count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_shell_dcrat_forkbomb_payload_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_forkbomb/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_forkbomb/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml b/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml index 402a4c4b2c..c091ed308c 100644 --- a/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml +++ b/detections/endpoint/windows_compatibility_telemetry_suspicious_child_process.yml @@ -1,22 +1,43 @@ name: Windows Compatibility Telemetry Suspicious Child Process id: 56fe46ca-ffef-46fe-8f0e-5cd4b7b4cc0c -version: 2 -date: '2025-02-13' +version: 3 +date: '2025-03-27' author: Steven Dick status: production type: TTP -description: The following analytic detects the execution of CompatTelRunner.exe with parameters indicative of a process not part of the normal "Microsoft Compatibility Appraiser" telemetry collection. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line arguments. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system. -data_source: +description: The following analytic detects the execution of CompatTelRunner.exe with + parameters indicative of a process not part of the normal "Microsoft Compatibility + Appraiser" telemetry collection. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names, parent processes, and command-line arguments. + This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility + Appraiser" task always run as System and can be used to elevate privileges or establish + a highly privileged persistence mechanism. If confirmed malicious, this could enable + unauthorized code execution, privilege escalation, or persistent access to the compromised + system. +data_source: - Windows Event Log Security 4688 - Sysmon EventID 1 - CrowdStrike ProcessRollup2 -search: |- - | tstats `security_content_summariesonly` values(Processes.parent_process) as Processes.parent_process, values(Processes.process) as Processes.process values(Processes.process_current_directory) AS process_current_directory, values(Processes.process_id) as Processes.process_id, values(Processes.process_guid) as Processes.process_guid, count min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = "CompatTelRunner.exe" AND Processes.process="* -cv:*" NOT Processes.process IN ("* -m:*") BY _time span=1h Processes.user Processes.dest Processes.parent_process_name Processes.process_name - |`drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_compatibility_telemetry_suspicious_child_process_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: "| tstats `security_content_summariesonly` count min(_time) AS firstTime,\ + \ max(_time) AS lastTime FROM datamodel=Endpoint.Processes \nwhere Processes.parent_process_name\ + \ = \"CompatTelRunner.exe\" AND Processes.process=\"* -cv:*\" NOT Processes.process\ + \ IN (\"* -m:*\") \nby Processes.action Processes.dest Processes.original_file_name\ + \ Processes.parent_process Processes.parent_process_exec \nProcesses.parent_process_guid\ + \ Processes.parent_process_id Processes.parent_process_name \nProcesses.parent_process_path\ + \ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash\ + \ \nProcesses.process_id Processes.process_integrity_level Processes.process_name\ + \ Processes.process_path \nProcesses.user Processes.user_id Processes.vendor_product\ + \ \n|`drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)` \n\ + | `security_content_ctime(lastTime)`\n| `windows_compatibility_telemetry_suspicious_child_process_filter`" +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: None identified references: - https://attack.mitre.org/techniques/T1546/ @@ -28,31 +49,37 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate processes on $dest$ - search: '| from datamodel Endpoint.Processes -| search dest = "$dest$" AND process_name = "$process_name$"' +- name: Investigate processes on $dest$ + search: '| from datamodel Endpoint.Processes | search dest = "$dest$" AND process_name + = "$process_name$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The process $process_name$ was launched in a suspicious manner by $parent_process_name$ on host $dest$ - risk_objects: + message: The process $process_name$ was launched in a suspicious manner by $parent_process_name$ + on host $dest$ + risk_objects: - field: dest type: system score: 70 - threat_objects: + threat_objects: - field: process_name type: process tags: - analytic_story: + analytic_story: - Windows Persistence Techniques asset_type: Endpoint - mitre_attack_id: + mitre_attack_id: - T1546 - T1053.005 - product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud @@ -62,4 +89,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/compattelrunner_abuse/compattelrunner_abuse.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml b/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml index cb280a0f87..ffe5838308 100644 --- a/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml +++ b/detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml @@ -1,21 +1,39 @@ name: Windows Compatibility Telemetry Tampering Through Registry id: 43834687-cc48-4878-a2fa-f76e4271791f -version: 2 -date: '2025-02-13' +version: 3 +date: '2025-03-27' author: Steven Dick status: production type: TTP -description: This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. It leverages data from the Endpoint.Registry data model, focusing on registry paths and values indicative of such changes. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system. -data_source: +description: This detection identifies suspicious modifications to the Windows Compatibility + Telemetry registry settings, specifically within the "TelemetryController" registry + key and "Command" registry value. It leverages data from the Endpoint.Registry data + model, focusing on registry paths and values indicative of such changes. This activity + is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" + task always run as System and can be used to elevate privileges or establish a highly + privileged persistence mechanism. If confirmed malicious, this could enable unauthorized + code execution, privilege escalation, or persistent access to the compromised system. +data_source: - Sysmon EventID 13 -search: |- - | tstats `security_content_summariesonly` min(_time) as firstTime, max(_time) as lastTime, count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*" AND Registry.registry_value_name="Command" NOT Registry.registry_value_data IN ("(empty)")) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` - | eval process = registry_value_data - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_compatibility_telemetry_tampering_through_registry_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: "| tstats `security_content_summariesonly` min(_time) as firstTime, max(_time)\ + \ as lastTime, count FROM datamodel=Endpoint.Registry \nWHERE (Registry.registry_path\ + \ = \"*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\ + \\TelemetryController*\" \nAND Registry.registry_value_name=\"Command\" NOT Registry.registry_value_data\ + \ IN (\"(empty)\")) \nby Registry.action Registry.dest Registry.process_guid Registry.process_id\ + \ Registry.registry_hive Registry.registry_path \nRegistry.registry_key_name Registry.registry_value_data\ + \ Registry.registry_value_name \nRegistry.registry_value_type Registry.status Registry.user\ + \ Registry.vendor_product \n| `drop_dm_object_name(Registry)`\n| eval process =\ + \ registry_value_data \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n\ + | `windows_compatibility_telemetry_tampering_through_registry_filter`" +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: None identified references: - https://attack.mitre.org/techniques/T1546/ @@ -27,34 +45,40 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$","$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$","$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate registry changes on $dest$ - search: '| from datamodel Endpoint.Registry -| search registry_path = "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*" AND dest = "$dest$"' +- name: Investigate registry changes on $dest$ + search: '| from datamodel Endpoint.Registry | search registry_path = "*\\SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\AppCompatFlags\\TelemetryController*" AND dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The process $process$ was added to registry settings for the Compatibility Appraiser by $user$ on host $dest$ - risk_objects: + message: The process $process$ was added to registry settings for the Compatibility + Appraiser by $user$ on host $dest$ + risk_objects: - field: dest type: system score: 70 - field: user type: user score: 70 - threat_objects: + threat_objects: - field: process type: process tags: - analytic_story: + analytic_story: - Windows Persistence Techniques asset_type: Endpoint - mitre_attack_id: + mitre_attack_id: - T1546 - T1053.005 - product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud diff --git a/detections/endpoint/windows_conhost_with_headless_argument.yml b/detections/endpoint/windows_conhost_with_headless_argument.yml index 819c297afd..cec110981b 100644 --- a/detections/endpoint/windows_conhost_with_headless_argument.yml +++ b/detections/endpoint/windows_conhost_with_headless_argument.yml @@ -1,6 +1,6 @@ name: Windows ConHost with Headless Argument id: d5039508-998d-4cfc-8b5e-9dcd679d9a62 -version: 5 +version: 6 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,13 @@ description: The following analytic detects the unusual invocation of the Window compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=conhost.exe - Processes.process="*--headless *" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_conhost_with_headless_argument_filter`' + Processes.process="*--headless *" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_conhost_with_headless_argument_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.003/headless/4688_conhost_headless.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.003/headless/4688_conhost_headless.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index c555bb46ba..7d64f2873f 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -1,6 +1,6 @@ name: Windows Create Local Administrator Account Via Net id: 2c568c34-bb57-4b43-9d75-19c605b98e70 -version: 3 +version: 4 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -17,15 +17,19 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.user) as - user values(Processes.parent_process) as parent_process values(parent_process_name) - as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND Processes.process=*/add* AND Processes.process IN ("*administrators*", - "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", - "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*") by - Processes.process Processes.process_name Processes.parent_process_name Processes.dest - Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_create_local_administrator_account_via_net_filter`' +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ + \ as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process=*/add*\ + \ AND Processes.process IN (\"*administrators*\", \"*administratoren*\", \"*administrateurs*\"\ + , \"*administrador*\", \"*amministratori*\", \"*administratorer*\", \"*Rendszergazda*\"\ + , \"*\u0410\u0434\u043C\u0438\u043D\u0438\u0441\u0442\u0440\u0430\u0442\u043E\u0440\ + *\", \"*Administrat\xF6r*\") by Processes.action Processes.dest Processes.original_file_name\ + \ Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid\ + \ Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path\ + \ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash\ + \ Processes.process_id Processes.process_integrity_level Processes.process_name\ + \ Processes.process_path Processes.user Processes.user_id Processes.vendor_product\ + \ | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ + \ | `windows_create_local_administrator_account_via_net_filter`" how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index b33e006ced..2d4347504f 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -1,6 +1,6 @@ name: Windows Credential Dumping LSASS Memory Createdump id: b3b7ce35-fce5-4c73-85f4-700aeada81a9 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=createdump.exe OR Processes.original_file_name="FX_VER_INTERNALNAME_STR" Processes.process="*-u - *" AND Processes.process="*-f *" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_credential_dumping_lsass_memory_createdump_filter`' + *" AND Processes.process="*-f *" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_dumping_lsass_memory_createdump_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml b/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml index 6f06b76cf8..9264cea456 100644 --- a/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml +++ b/detections/endpoint/windows_credentials_access_via_vaultcli_module.yml @@ -1,6 +1,6 @@ name: Windows Credentials Access via VaultCli Module id: c0d89118-3f89-4cd7-8140-1f39e7210681 -version: 3 +version: 4 date: '2025-02-17' author: Teoderick Contreras, Splunk data_source: @@ -20,9 +20,11 @@ search: '`sysmon` EventCode=7 ImageLoaded ="*\\vaultcli.dll" process_path IN("* "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\appdata\\local\\temp\\*", "*\\PerfLogs\\*", "*:\\temp\\*") - | stats count min(_time) as firstTime max(_time) as lastTime by dest Image ImageLoaded - process_name EventCode Signed ProcessId | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `windows_credentials_access_via_vaultcli_module_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image + ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid + process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_credentials_access_via_vaultcli_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.004/vaultcli_creds/vaultcli.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.004/vaultcli_creds/vaultcli.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml index 175b3c6ffd..683fa06ed0 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml @@ -1,6 +1,6 @@ name: Windows Credentials from Password Stores Chrome Copied in TEMP Dir id: 4d14c86d-fdee-4393-94da-238d2706902f -version: 3 +version: 4 date: '2025-02-10' author: Teoderick Contreras, Splunk data_source: @@ -15,10 +15,12 @@ description: The following analytic detects the copying of Chrome's Local State typically processes the stolen data. Identifying this behavior enables security teams to act quickly, preventing attackers from decrypting and exfiltrating sensitive browser credentials and mitigating the risk of unauthorized access. -search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("Local - State", "Login Data") Filesystem.file_path = "*\\temp\\*" by _time Filesystem.dest - Filesystem.user Filesystem.file_name Filesystem.file_path Filesystem.file_create_time + State", "Login Data") Filesystem.file_path = "*\\temp\\*" by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_copied_in_temp_dir_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_creation.yml b/detections/endpoint/windows_credentials_from_password_stores_creation.yml index 78fa620d8c..9a6b6abe7d 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_creation.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_creation.yml @@ -1,6 +1,6 @@ name: Windows Credentials from Password Stores Creation id: c0c5a479-bf57-4ca0-af3a-4c7081e5ba05 -version: 5 +version: 6 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -20,9 +20,12 @@ description: The following analytic detects the execution of the Windows OS tool search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmdkey.exe" OR Processes.original_file_name = "cmdkey.exe" AND Processes.process = "*/generic*" - Processes.process IN ("*/user*", "*/password*") by Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name - Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user + Processes.process IN ("*/user*", "*/password*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_creation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/cmdkey_create_credential_store/cmdkey_gen_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/cmdkey_create_credential_store/cmdkey_gen_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_deletion.yml b/detections/endpoint/windows_credentials_from_password_stores_deletion.yml index 19a1bef08d..5122fd5c0c 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_deletion.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_deletion.yml @@ -1,6 +1,6 @@ name: Windows Credentials from Password Stores Deletion id: 46d676aa-40c6-4fe6-b917-d23b621f0f89 -version: 5 +version: 6 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ description: The following analytic detects the execution of the Windows OS tool search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmdkey.exe" OR Processes.original_file_name = "cmdkey.exe" AND Processes.process = "*/delete*" - by Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_deletion_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_deletion_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/cmdkey_del_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/cmdkey_del_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_query.yml b/detections/endpoint/windows_credentials_from_password_stores_query.yml index c8225b75ad..797837666c 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_query.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_query.yml @@ -1,6 +1,6 @@ name: Windows Credentials from Password Stores Query id: db02d6b4-5d5b-4c33-8d8f-f0577516a8c7 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmdkey.exe" OR Processes.original_file_name = "cmdkey.exe" AND Processes.process = "*/list*" - by Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_query_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_query_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml b/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml index 65a935a496..2280408737 100644 --- a/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml +++ b/detections/endpoint/windows_credentials_from_web_browsers_saved_in_temp_folder.yml @@ -1,6 +1,6 @@ name: Windows Credentials from Web Browsers Saved in TEMP Folder id: b36b23ea-763c-417b-bd4a-6a378dabad1a -version: 3 +version: 4 date: '2025-02-10' author: Teoderick Contreras, Splunk data_source: @@ -17,9 +17,12 @@ description: The following analytic detects the creation of files containing pas of unauthorized access to user accounts and systems. search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("login*", - "pass*","cookie*","master_key*") Filesystem.file_path = "*\\temp\\*" by _time Filesystem.file_name - Filesystem.file_path Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_web_browsers_saved_in_temp_folder_filter`' + "pass*","cookie*","master_key*") Filesystem.file_path = "*\\temp\\*" by Filesystem.action + Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash + Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user + Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_credentials_from_web_browsers_saved_in_temp_folder_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -65,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_in_registry_reg_query.yml b/detections/endpoint/windows_credentials_in_registry_reg_query.yml index c0718bc539..dda02393bf 100644 --- a/detections/endpoint/windows_credentials_in_registry_reg_query.yml +++ b/detections/endpoint/windows_credentials_in_registry_reg_query.yml @@ -1,6 +1,6 @@ name: Windows Credentials in Registry Reg Query id: a8b3124e-2278-4b73-ae9c-585117079fb2 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -22,9 +22,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime = "* query *" AND Processes.process IN ("*\\Software\\ORL\\WinVNC3\\Password*", "*\\SOFTWARE\\RealVNC\\WinVNC4 /v password*", "*\\CurrentControlSet\\Services\\SNMP*", "*\\Software\\TightVNC\\Server*", "*\\Software\\SimonTatham\\PuTTY\\Sessions*", - "*\\Software\\OpenSSH\\Agent\\Keys*", "*password*") by Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name - Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user + "*\\Software\\OpenSSH\\Agent\\Keys*", "*password*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_in_registry_reg_query_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 95fd1c0638..9348119cc9 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,7 +1,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: '11' -date: '2025-03-03' +version: 12 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: TTP @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_download_to_suspicious_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 8b99b345c5..19940a77d5 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -1,6 +1,6 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process - IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`' + IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_curl_upload_to_remote_destination_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml index 2eeeeb2fdd..fa4b5093a1 100644 --- a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml +++ b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml @@ -1,6 +1,6 @@ name: Windows Data Destruction Recursive Exec Files Deletion id: 3596a799-6320-4a2f-8772-a9e98ddb2960 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,10 +17,13 @@ data_source: - Sysmon EventID 23 - Sysmon EventID 26 search: '`sysmon` EventCode IN ("23","26") TargetFilename IN ("*.exe", "*.sys", "*.dll") - | bin _time span=2m | stats count, values(TargetFilename) as deleted_files, min(_time) - as firstTime, max(_time) as lastTime by user, dest, signature, signature_id, Image, - process_name, process_guid | rename Image as process | where count >=100 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_data_destruction_recursive_exec_files_deletion_filter`' + | bin _time span=2m | stats count min(_time) as firstTime, max(_time) as lastTime + values(file_path) as file_path values(file_hash) as file_hash values(file_name) + as file_name values(file_modify_time) as file_modify_time values(process_name) as + process_name values(process_path) as process_path values(process_guid) as process_guid + values(process_id) as process_id values(process_exec) as process_exec by action + dest dvc signature signature_id user user_id vendor_product | where count >=100 + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_data_destruction_recursive_exec_files_deletion_filter`' how_to_implement: To successfully implement this search, you need to ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed. @@ -53,9 +56,7 @@ rba: - field: dest type: system score: 64 - threat_objects: - - field: deleted_files - type: file_name + threat_objects: [] tags: analytic_story: - Swift Slicer @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/swift_slicer/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/swift_slicer/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_debugger_tool_execution.yml b/detections/endpoint/windows_debugger_tool_execution.yml index 19bcd73533..69adeced74 100644 --- a/detections/endpoint/windows_debugger_tool_execution.yml +++ b/detections/endpoint/windows_debugger_tool_execution.yml @@ -1,6 +1,6 @@ name: Windows Debugger Tool Execution id: e14d94a3-07fb-4b47-8406-f5e37180d422 -version: 3 +version: 4 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: [] @@ -14,10 +14,13 @@ description: This analysis detects the use of debugger tools within a production search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "x32dbg.exe" OR Processes.process_name = "x64dbg.exe" OR Processes.process_name = "windbg.exe" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_debugger_tool_execution_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_debugger_tool_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -47,7 +50,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/debugger_execution/debugger.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/debugger_execution/debugger.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml index d2fb815e5d..042d104f0c 100644 --- a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml +++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml @@ -1,6 +1,6 @@ name: Windows Defacement Modify Transcodedwallpaper File id: e11c3d90-5bc7-42ad-94cd-ba75db10d897 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -14,19 +14,40 @@ description: The following analytic identifies modifications to the TranscodedWa If confirmed malicious, this could be a sign of unauthorized access and tampering, potentially leading to further system compromise or data exfiltration. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_path !="*\\Windows\\Explorer.EXE" by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.process_guid Processes.original_file_name - | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, - _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid | fields file_name file_path process_name process_path - process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`' +- Sysmon EventID 1 AND Sysmon EventID 11 +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path + !="*\\Windows\\Explorer.EXE" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path + = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by Filesystem.action + Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash + Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user + Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + file_access_time file_create_time file_hash file_modify_time file_name file_path + file_acl file_size firstTime lastTime | stats values(action) as action values(dest) + as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) + | `windows_defacement_modify_transcodedwallpaper_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, @@ -75,7 +96,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml index efebc1aedd..f0266692e6 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -1,6 +1,6 @@ name: Windows Default Group Policy Object Modified id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876 -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,7 +20,7 @@ search: '`wineventlog_security` EventCode=5136 ObjectClass=groupPolicyContainer (ObjectDN="CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=*" OR ObjectDN="CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=POLICIES,CN=SYSTEM,DC=*") | stats min(_time) as firstTime max(_time) as lastTime by ObjectDN SubjectUserSid - AttributeValue Computer DSName | rename AttributeValue as versionNumber | `security_content_ctime(firstTime)` + AttributeValue Computer DSName dest | rename AttributeValue as versionNumber | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_filter`' how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be @@ -73,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml index 51664cc7ba..9e91875a60 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml @@ -1,6 +1,6 @@ name: Windows Default Group Policy Object Modified with GPME id: eaf688b3-bb8f-454d-b105-920a862cd8cb -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -20,10 +20,14 @@ description: The following analytic detects modifications to default Group Polic search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mmc.exe (Processes.process =*gpme.msc*) AND (Processes.process = "*31B2F340-016D-11D2-945F-00C04FB984F9*" - OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*" ) by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_default_group_policy_object_modified_with_gpme_filter`' + OR Processes.process = "*6AC1786C-016F-11D2-945F-00C04fB984F9*" ) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_default_group_policy_object_modified_with_gpme_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_defender_asr_block_events.yml b/detections/endpoint/windows_defender_asr_block_events.yml index 8192e5b189..2d4c60fb86 100644 --- a/detections/endpoint/windows_defender_asr_block_events.yml +++ b/detections/endpoint/windows_defender_asr_block_events.yml @@ -76,5 +76,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/defender/asr_block.log - source: WinEventLog:Microsoft-Windows-Windows Defender/Operational + source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index efb6be570b..4b74ff632d 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -1,6 +1,6 @@ name: Windows Defender Exclusion Registry Entry id: 13395a44-4dd9-11ec-9df7-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -16,10 +16,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows - Defender\\Exclusions\\*") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_exclusion_registry_entry_filter`' + Defender\\Exclusions\\*") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_defender_exclusion_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_delete_or_modify_system_firewall.yml b/detections/endpoint/windows_delete_or_modify_system_firewall.yml index db9789944c..dc7a2fe9f7 100644 --- a/detections/endpoint/windows_delete_or_modify_system_firewall.yml +++ b/detections/endpoint/windows_delete_or_modify_system_firewall.yml @@ -1,6 +1,6 @@ name: Windows Delete or Modify System Firewall id: b188d11a-eba7-419d-b8b6-cc265b4f2c4f -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ description: The following analytic identifies 'netsh' processes that delete or further compromise and persistence within the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process - = "* firewall *" Processes.process = "* del*" by Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process_id Processes.process_guid Processes.process - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_delete_or_modify_system_firewall_filter`' + = "* firewall *" Processes.process = "* del*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_delete_or_modify_system_firewall_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml index cea12cb9f7..6bf5de4802 100644 --- a/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml +++ b/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml @@ -1,6 +1,6 @@ name: Windows Deleted Registry By A Non Critical Process File Path id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -15,17 +15,37 @@ description: The following analytic detects the deletion of registry keys by non data_source: - Sysmon EventID 1 AND Sysmon EventID 12 - Sysmon EventID 1 AND Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - WHERE Registry.action=deleted BY _time span=1h Registry.dest Registry.registry_path - Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data - Registry.action | `drop_dm_object_name(Registry)` | join process_guid [| tstats - `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT - (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h - Processes.process_id Processes.process_name Processes.process Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)`] - | fields _time parent_process_name parent_process process_name process_path process - process_guid registry_path registry_value_name registry_value_data registry_key_name - action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path + IN ("*\\windows\\*", "*\\program files*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=deleted + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | table action dest original_file_name parent_process + parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path + process process_exec process_guid process_hash process_id process_integrity_level + process_name process_path user user_id vendor_product registry_hive registry_path + registry_key_name registry_value_data registry_value_name registry_value_type status + | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(registry_hive) as registry_hive values(registry_path) as + registry_path values(registry_key_name) as registry_key_name values(registry_value_data) + as registry_value_data values(registry_value_name) as registry_value_name values(registry_value_type) + as registry_value_type values(status) as status by process_guid | where isnotnull(process_path) + AND isnotnull(registry_value_name) | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +96,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_detect_network_scanner_behavior.yml b/detections/endpoint/windows_detect_network_scanner_behavior.yml index 0f75aeb776..f87c888d23 100644 --- a/detections/endpoint/windows_detect_network_scanner_behavior.yml +++ b/detections/endpoint/windows_detect_network_scanner_behavior.yml @@ -1,6 +1,6 @@ name: Windows Detect Network Scanner Behavior id: 78e678d2-bf64-4fe6-aa52-2f7b11dddee7 -version: 4 +version: 5 date: '2025-02-10' author: Steven Dick status: production @@ -13,18 +13,22 @@ description: The following analytic detects when an application is used to conne macro prior to activation. data_source: - Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count latest(All_Traffic.dest_port) - as dest_port dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count +search: '| tstats `security_content_summariesonly` count values(All_Traffic.action) + as action values(All_Traffic.dest) as dest values(All_Traffic.dest_port) as dest_port + values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dvc) as dvc values(All_Traffic.direction) + as direction values(All_Traffic.protocol) as protocol values(All_Traffic.protocol_version) + as protocol_version values(All_Traffic.src_port) as src_port values(All_Traffic.transport) + as transport dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port - IN (8443,8080,5353,3268,443,389,88,80,53,25) by host,All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user - _time span=5m | `drop_dm_object_name(All_Traffic)` | rex field=app ".*\\\(?.*)$" - | where port_count > 10 OR dest_count > 10 | stats latest(src) as src, latest(src_ip) - as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) - as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) - as count by host,user,app,process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_detect_network_scanner_behavior_filter`' + IN (8443,8080,5353,3268,443,389,88,80,53,25) by All_Traffic.app All_Traffic.src + All_Traffic.src_ip All_Traffic.user All_Traffic.vendor_product _time span=5m | `drop_dm_object_name(All_Traffic)` + | rex field=app ".*\\\(?.*)$" | where port_count > 10 OR dest_count + > 10 | stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, + max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as + firstTime, max(lastTime) as lastTime, max(count) as count by user,app,process_name + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_detect_network_scanner_behavior_filter`' how_to_implement: This detection relies on Sysmon EventID 3 events being ingested AND tagged into the Network_Traffic datamodel. known_false_positives: Various, could be noisy depending on processes in the organization @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/sysmon_scanning_events/sysmon_scanning_events.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/sysmon_scanning_events/sysmon_scanning_events.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 80d78db6c7..5cc11ac67c 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -1,14 +1,13 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 -version: 8 +version: 9 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly description: The following analytic detects a suspicious registry modification that disables the Change Password feature on a Windows host. It identifies changes to - the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" + the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" with a value of "0x00000001". This activity is significant as it can prevent users from changing their passwords, a tactic often used by ransomware to maintain control over compromised systems. If confirmed malicious, this could hinder user response @@ -18,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" - Registry.registry_value_data = "0x00000001") BY Registry.dest Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_disable_change_password_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 79a871d9e3..a4b15ba2c1 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -1,14 +1,13 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 -version: 8 +version: 9 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly description: The following analytic detects a suspicious registry modification that disables the Lock Computer feature in Windows. It leverages data from the Endpoint.Registry - data model, specifically monitoring changes to the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" + data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" with a value of "0x00000001". This activity is significant because it prevents users from locking their screens, a tactic often used by malware, including ransomware, to maintain control over compromised systems. If confirmed malicious, this could @@ -18,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" - Registry.registry_value_data = "0x00000001") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_disable_lock_workstation_feature_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 297248d2dd..7bc13cd866 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -1,6 +1,6 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 -version: 8 +version: 9 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data - = "0x00000001") BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`' + = "0x00000001") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index d550077307..faa6ef7862 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -1,6 +1,6 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,9 +17,10 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled") - AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_memory_crash_dump_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index 18df486d23..e2e905398b 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -1,6 +1,6 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 -version: 8 +version: 9 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -16,11 +16,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= - "DisableNotificationCenter" Registry.registry_value_data = "0x00000001") BY Registry.dest - Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_disable_notification_center_filter`' + "DisableNotificationCenter" Registry.registry_value_data = "0x00000001") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_disable_notification_center_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index 89f5df049c..d90bf1e93a 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -1,6 +1,6 @@ name: Windows Disable or Modify Tools Via Taskkill id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ description: The following analytic identifies the use of taskkill.exe to forcib search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") - by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_or_modify_tools_via_taskkill_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -76,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill/taskkill_im.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill/taskkill_im.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 2447b0a67e..88afdbd5a2 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,6 +1,6 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 3 +version: 4 date: '2025-02-10' author: Teoderick Contreras, Splunk data_source: @@ -18,10 +18,13 @@ description: The following analytic detects the use of the taskkill command in a search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*taskkill*" Processes.process IN("*chrome.exe","*firefox.exe","*brave.exe","*opera.exe","*msedge.exe","*chromium.exe") - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_disable_or_stop_browser_process_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_disable_or_stop_browser_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill_browser/braodo_taskkill.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/taskkill_browser/braodo_taskkill.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index f881222690..8b50e01c05 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -1,6 +1,6 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 8 +version: 9 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -18,10 +18,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" - Registry.registry_value_data = "0x00000001")) BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`' + Registry.registry_value_data = "0x00000001")) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_disable_shutdown_button_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 05bec76722..fe78f043c8 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -1,6 +1,6 @@ name: Windows Disable Windows Event Logging Disable HTTP Logging id: 23fb6787-255f-4d5b-9a66-9fd7504032b5 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe Processes.process - IN ("*set config*", "*httplogging*","*dontlog:true*") by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_windows_event_logging_disable_http_logging_filter`' + IN ("*set config*", "*httplogging*","*dontlog:true*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_disable_windows_event_logging_disable_http_logging_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -87,7 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index a802e83337..58f1232398 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -1,6 +1,6 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 9 +version: 10 date: '2024-12-16' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -20,10 +20,12 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") - Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.dest Registry.user - Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_windows_group_policy_features_through_registry_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_disable_windows_group_policy_features_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index ddda0ec6af..b6771d7af2 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -1,6 +1,6 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb -version: 6 +version: 7 date: '2025-02-10' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk status: production @@ -18,9 +18,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware" - AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' + AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -71,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 0be876557c..4a75eaebcc 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -1,6 +1,6 @@ name: Windows DiskCryptor Usage id: d56fe0c8-4650-11ec-a8fa-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe" - OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' + OR Processes.original_file_name=dcinst.exe) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -52,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/dcrypt/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index ab85e79c51..4e4fff67bc 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -1,6 +1,6 @@ name: Windows Diskshadow Proxy Execution id: 58adae9e-8ea3-11ec-90f6-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Lou Stella, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_diskshadow` (Processes.process=*-s* - OR Processes.process=*/s*) by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_diskshadow_proxy_execution_filter`' + OR Processes.process=*/s*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_diskshadow_proxy_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/diskshadow/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dism_install_powershell_web_access.yml b/detections/endpoint/windows_dism_install_powershell_web_access.yml index bf908d0a4f..1c14587e4b 100644 --- a/detections/endpoint/windows_dism_install_powershell_web_access.yml +++ b/detections/endpoint/windows_dism_install_powershell_web_access.yml @@ -1,6 +1,6 @@ name: Windows DISM Install PowerShell Web Access id: fa6142a7-c364-4d11-9954-895dd9efb2d4 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk data_source: @@ -19,10 +19,13 @@ description: The following analytic detects the installation of PowerShell Web A search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe (Processes.process="*WindowsPowerShellWebAccess*" AND Processes.process="*/online*" - AND Processes.process="*/enable-feature*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_dism_install_powershell_web_access_filter`' + AND Processes.process="*/enable-feature*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dism_install_powershell_web_access_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Security diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index 8371b710fb..1c39f0fdbb 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -1,6 +1,6 @@ name: Windows DISM Remove Defender id: 8567da9e-47f0-11ec-99a9-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*" - AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`' + AND Processes.process="*/remove*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index 709369aecf..ca231603c2 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -1,6 +1,6 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,11 @@ data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = - True | stats count min(_time) as firstTime max(_time) as lastTime values(process_name) - as process_name by _time dest loaded_file | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' + True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded + dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash + process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The search is written against the latest Sysmon TA 4.0 https://splunkbase.splunk.com/app/5709. For this specific event ID 7, the sysmon TA will extract the ImageLoaded name to the loaded_file field which is used in the search to compare against the hijacklibs @@ -43,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml index d5d279ce64..39a60c4b64 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -1,6 +1,6 @@ name: Windows DLL Search Order Hijacking with iscsicpl id: f39ee679-3b1e-4f47-841c-5c3c580acda2 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=iscsicpl.exe - `windows_shells` by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `windows_dll_search_order_hijacking_with_iscsicpl_filter`' + `windows_shells` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_dll_search_order_hijacking_with_iscsicpl_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml index 6e02110e63..397962898a 100644 --- a/detections/endpoint/windows_dll_side_loading_in_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml @@ -1,6 +1,6 @@ name: Windows DLL Side-Loading In Calc id: af01f6db-26ac-440e-8d89-2793e303f137 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\sysWow64\\*")) AND NOT(ImageLoaded IN("*:\\windows\\system32\\*", - "*:\\windows\\sysWow64\\*", "*:\\windows\\WinSXS\\*")) | stats count min(_time) - as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product - process_name dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` + "*:\\windows\\sysWow64\\*", "*:\\windows\\WinSXS\\*")) | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file + loaded_file_path original_file_name process_exec process_guid process_hash process_id + process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_side_loading_in_calc_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml index 3d856442b6..848aa34fab 100644 --- a/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml +++ b/detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml @@ -1,6 +1,6 @@ name: Windows DLL Side-Loading Process Child Of Calc id: 295ca9ed-e97b-4520-90f7-dfb6469902e1 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ description: The following analytic identifies suspicious child processes spawne environment. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name - = "calc.exe") AND Processes.process_name != "win32calc.exe" by Processes.parent_process - Processes.process_name Processes.process_id Processes.process_guid Processes.process - Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_dll_side_loading_process_child_of_calc_filter`' + = "calc.exe") AND Processes.process_name != "win32calc.exe" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_dll_side_loading_process_child_of_calc_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml index aa8aa701f0..2d84d9893f 100644 --- a/detections/endpoint/windows_dns_gather_network_info.yml +++ b/detections/endpoint/windows_dns_gather_network_info.yml @@ -1,6 +1,6 @@ name: Windows DNS Gather Network Info id: 347e0892-e8f3-4512-afda-dc0e3fa996f3 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk type: Anomaly @@ -18,10 +18,13 @@ description: The following analytic detects the use of the dnscmd.exe command to leading to data exfiltration or further compromise of the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dnscmd.exe" - Processes.process = "* /enumrecords *" by Processes.parent_process Processes.process_name - Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest - | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_dns_gather_network_info_filter`' + Processes.process = "* /enumrecords *" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dns_gather_network_info_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml b/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml index ad894aeeb8..8c8ba50133 100644 --- a/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml +++ b/detections/endpoint/windows_domain_account_discovery_via_get_netcomputer.yml @@ -1,6 +1,6 @@ name: Windows Domain Account Discovery Via Get-NetComputer id: a7fbbc4e-4571-424a-b627-6968e1c939e4 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,10 @@ description: The following analytic detects the execution of the PowerView Power movement within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-NetComputer*" ScriptBlockText IN ("*samaccountname*", "*accountexpires*", "*lastlogon*", "*lastlogoff*", "*pwdlastset*", - "*logoncount*") | rename Computer as dest, UserID as user | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_domain_account_discovery_via_get_netcomputer_filter`' + "*logoncount*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime + by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path + ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `windows_domain_account_discovery_via_get_netcomputer_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= @@ -62,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index 806aa64509..a3b2fe6887 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,6 +1,6 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f -version: 6 +version: 7 date: '2025-01-20' author: Mauricio Velazco, Splunk status: production @@ -26,11 +26,12 @@ description: The following analytic identifies potential Kerberos ticket forging validated as a true positive, this indicates that an attacker has successfully forged a Kerberos ticket and may have gained unauthorized access to critical resources, potentially with elevated privileges. -search: '`wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN - ("*$", "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") - | where match(GroupMembership, "Domain Admins") | stats count by _time, TargetUserName, - GroupMembership, host | lookup domain_admins username as TargetUserName OUTPUT username - | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter`' +search: '`wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName IN ("*$", + "SYSTEM", "DWM-*","LOCAL SERVICE","NETWORK SERVICE", "ANONYMOUS LOGON", "UMFD-*") + | where match(GroupMembership, "Domain Admins") | stats count by _time TargetUserName + GroupMembership action app dest signature_id user vendor_product | lookup domain_admins + username as TargetUserName OUTPUT username | fillnull value=NotDA username | search + username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Authentication events across all endpoints and ingest Event Id 4627. Specifically, the Audit Group Membership subcategory within the Logon Logoff category needs to diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index 55465e1839..8e27a1f30a 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -21,11 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by - Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.original_file_name Processes.process_path - Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `is_net_windows_file_macro` - | `windows_dotnet_binary_in_non_standard_path_filter`' + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `is_net_windows_file_macro` | `windows_dotnet_binary_in_non_standard_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -92,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index 7e3badca4e..9ab85a2248 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -1,6 +1,6 @@ name: Windows Drivers Loaded by Signature id: d2d4af6a-6c2b-4d79-80c5-fc2cf12a2f68 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -14,17 +14,17 @@ description: The following analytic identifies all drivers being loaded on Windo leading to severe system compromise and potential data exfiltration. data_source: - Sysmon EventID 6 -search: '`sysmon` EventCode=6 | stats min(_time) as firstTime max(_time) as lastTime - values(ImageLoaded) count by dest Signed Signature service_signature_verified service_signature_exists - Hashes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`sysmon` EventCode=6 | stats count min(_time) as firstTime max(_time) as + lastTime by ImageLoaded dest dvc process_hash process_path signature signature_id + user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_drivers_loaded_by_signature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers. -known_false_positives: This analytic is meant to assist with identifying and hunting drivers loaded - in the environment. +known_false_positives: This analytic is meant to assist with identifying and hunting + drivers loaded in the environment. references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - https://attack.mitre.org/techniques/T1014/ @@ -47,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_enable_powershell_web_access.yml b/detections/endpoint/windows_enable_powershell_web_access.yml index 8e20aedce6..82ddf9694a 100644 --- a/detections/endpoint/windows_enable_powershell_web_access.yml +++ b/detections/endpoint/windows_enable_powershell_web_access.yml @@ -1,6 +1,6 @@ name: Windows Enable PowerShell Web Access id: 175bb2de-6227-416b-9678-9b61999cd21f -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk data_source: @@ -14,8 +14,9 @@ description: The following analytic detects the enabling of PowerShell Web Acces PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks. search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Install-WindowsFeature*WindowsPowerShellWebAccess*","*Install-PswaWebApplication*","*Add-PswaAuthorizationRule*UserName - *ComputerName *") | rename Computer as dest | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode ScriptBlockText dest UserID | `security_content_ctime(firstTime)` + *ComputerName *") | fillnull | stats count min(_time) as firstTime max(_time) as + lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_enable_powershell_web_access_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -62,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml b/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml index bc459fc57d..8ffe23702d 100644 --- a/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml +++ b/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml @@ -1,6 +1,6 @@ name: Windows Enable Win32 ScheduledJob via Registry id: 12c80db8-ef62-4456-92df-b23e1b3219f6 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: Anomaly @@ -18,9 +18,11 @@ description: The following analytic detects the creation of a new DWORD value na search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Schedule\\Configuration*" - Registry.registry_value_name=EnableAt by Registry.dest, Registry.user, Registry.registry_value_name, - Registry.registry_value_type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` | `windows_enable_win32_scheduledjob_via_registry_filter`' + Registry.registry_value_name=EnableAt by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_enable_win32_scheduledjob_via_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, @@ -77,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 373e172977..e797978c9b 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -1,6 +1,6 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 -version: 5 +version: 6 date: '2025-01-13' author: Michael Haag, Splunk status: production @@ -9,10 +9,29 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -description: This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process="*ESX Admins*" AND Processes.process="*/add*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_net_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: Legitimate administrators might create an "ESX Admins" group for valid reasons. Verify that the group creation is authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities. +description: This analytic detects attempts to create an "ESX Admins" group using + the Windows net.exe or net1.exe commands. This activity may indicate an attempt + to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability + (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi + hosts by recreating the "ESX Admins" group after its deletion from Active Directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" + Processes.process="*ESX Admins*" AND Processes.process="*/add*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_esx_admins_group_creation_via_net_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + data that records process activity from your hosts to populate the Endpoint data + model in the Processes node. If you are using Sysmon, you must have at least version + 6.0.4 of the Sysmon TA. +known_false_positives: Legitimate administrators might create an "ESX Admins" group + for valid reasons. Verify that the group creation is authorized and part of normal + administrative tasks. Consider the context of the action, such as the user performing + it and any related activities. references: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ @@ -23,7 +42,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml index fd301786bb..474a50be70 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml @@ -1,6 +1,6 @@ name: Windows ESX Admins Group Creation via PowerShell id: f48a5557-be06-4b96-b8e8-be563e387620 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk data_source: @@ -13,10 +13,10 @@ description: This analytic detects attempts to create an "ESX Admins" group usin Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the 'ESX Admins' group after its deletion from Active Directory. search: '`powershell` EventCode=4104 (ScriptBlockText="*New-ADGroup*" OR ScriptBlockText="*New-LocalGroup*") - ScriptBlockText="*ESX Admins*" | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest - | rename UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_esx_admins_group_creation_via_powershell_filter`' + ScriptBlockText="*ESX Admins*" | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. You can find additional setup instructions in the Splunk documentation for configuring PowerShell logging. @@ -29,12 +29,12 @@ references: - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -44,9 +44,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: PowerShell command to create "ESX Admins" group detected on host $dest$ - by user $user$. + by user $user_id$. risk_objects: - - field: user + - field: user_id type: user score: 56 - field: dest @@ -68,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-powershell-esxadmins.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-powershell-esxadmins.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index cff4ffa150..0ace7122de 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -1,6 +1,6 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a -version: 13 +version: 14 date: '2025-02-10' author: Rico Valdez, Michael Haag, Splunk status: production @@ -16,8 +16,10 @@ data_source: - Windows Event Log Security 1102 - Windows Event Log System 104 search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104) - | stats count min(_time) as firstTime max(_time) as lastTime by dest object EventCode - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter` + | stats count min(_time) as firstTime max(_time) as lastTime by action app change_type + dest dvc name object_attrs object_category signature signature_id src_user status + subject user vendor_product object EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_event_log_cleared_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. known_false_positives: It is possible that these logs may be legitimately cleared @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_event_logging_service_has_shutdown.yml b/detections/endpoint/windows_event_logging_service_has_shutdown.yml index ad327550a6..00a0280e77 100644 --- a/detections/endpoint/windows_event_logging_service_has_shutdown.yml +++ b/detections/endpoint/windows_event_logging_service_has_shutdown.yml @@ -1,16 +1,28 @@ name: Windows Event Logging Service Has Shutdown id: d696f622-6b08-4336-b456-696cb5b43ba0 -version: 1 +version: 2 date: '2025-01-28' author: Mauricio Velazco, Splunk status: production type: Hunting -description: The following analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior. +description: The following analytic detects the shutdown of the Windows Event Log + service by leveraging Windows Event ID 1100. This event is logged every time the + service stops, including during normal system shutdowns. Monitoring this activity + is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed + malicious, an attacker could hide their activities, making it difficult to trace + their actions and investigate further incidents. Analysts should verify if the shutdown + was planned and review other alerts and data sources for additional suspicious behavior. data_source: - Windows Event Log Security 1100 -search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by dest name EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_event_logging_service_has_shutdown_filter` -how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. -known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimate administration tasks. Investigate the cause of this issue and apply additional filters as needed. +search: '`wineventlog_security` EventCode=1100 | stats count min(_time) as firstTime + max(_time) as lastTime by action app change_type dest dvc name object_attrs object_category + service service_name signature signature_id status subject vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_event_logging_service_has_shutdown_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: It is possible the Event Logging service gets shut down due + to system errors or legitimate administration tasks. Investigate the cause of this + issue and apply additional filters as needed. references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100 - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads @@ -32,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml index 9267afdd3c..22d6c84284 100644 --- a/detections/endpoint/windows_excessive_service_stop_attempt.yml +++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml @@ -1,17 +1,45 @@ name: Windows Excessive Service Stop Attempt id: 8f3a614f-6b98-4f7d-82dd-d0df38452a8b -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects multiple attempts to stop or delete services on a system using `net.exe` or `sc.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture. +description: The following analytic detects multiple attempts to stop or delete services + on a system using `net.exe` or `sc.exe`. It leverages Endpoint Detection and Response + (EDR) telemetry, focusing on process names and command-line executions within a + one-minute window. This activity is significant as it may indicate an adversary + attempting to disable security or critical services to evade detection and further + their objectives. If confirmed malicious, this could lead to the attacker gaining + persistence, escalating privileges, or disrupting essential services, thereby compromising + the system's security posture. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR `process_sc`) AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_service_stop_attempt_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.action) as action + values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) + as user values(Processes.user_id) as user_id values(Processes.vendor_product) as + vendor_product count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (`process_net` OR `process_sc`) AND Processes.process="*stop*" OR Processes.process="*delete*" + by Processes.process_name Processes.original_file_name Processes.parent_process_name + Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -21,7 +49,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml index 10716cc575..871b5d61c4 100644 --- a/detections/endpoint/windows_excessive_usage_of_net_app.yml +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -1,17 +1,44 @@ name: Windows Excessive Usage Of Net App id: 355ba810-0a20-4215-8485-9ce3f87f2e38 -version: 2 +version: 3 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects excessive usage of `net.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining incidents. If confirmed malicious, this activity could lead to unauthorized user account manipulation, potentially compromising system integrity and enabling further malicious actions. +description: The following analytic detects excessive usage of `net.exe` within a + one-minute interval. It leverages data from Endpoint Detection and Response (EDR) + agents, focusing on process names, parent processes, and command-line executions. + This behavior is significant as it may indicate an adversary attempting to create, + delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining + incidents. If confirmed malicious, this activity could lead to unauthorized user + account manipulation, potentially compromising system integrity and enabling further + malicious actions. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_usage_of_net_app_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.action) as action + values(Processes.parent_process) as parent_process values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_path) as process_path values(Processes.user) + as user values(Processes.user_id) as user_id values(Processes.vendor_product) as + vendor_product count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name + Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_usage_of_net_app_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: unknown. Filter as needed. Modify the time span as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -21,7 +48,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_executable_in_loaded_modules.yml b/detections/endpoint/windows_executable_in_loaded_modules.yml index 0c64d5ae6e..16f9d84a8c 100644 --- a/detections/endpoint/windows_executable_in_loaded_modules.yml +++ b/detections/endpoint/windows_executable_in_loaded_modules.yml @@ -1,6 +1,6 @@ name: Windows Executable in Loaded Modules id: 3e27af56-fcf0-4113-988d-24969b062be7 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,12 @@ description: The following analytic identifies instances where executable files NjRAT, which uses this technique to load malicious modules. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, maintain persistence, and further compromise the host system. -search: '`sysmon` EventCode=7 ImageLoaded= *.exe | stats count min(_time) as firstTime - max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName - process_name Computer EventCode ProcessId Hashes IMPHASH | rename Computer as dest - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_executable_in_loaded_modules_filter`' +search: '`sysmon` EventCode=7 ImageLoaded= *.exe | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path + original_file_name process_exec process_guid process_hash process_id process_name + process_path service_dll_signature_exists service_dll_signature_verified signature + signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_executable_in_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -60,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index abbcec0359..085df9316e 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -1,6 +1,6 @@ name: Windows Execute Arbitrary Commands with MSDT id: e1d5145f-38fe-42b9-a5d5-457796715f97 -version: 9 +version: 10 date: '2024-12-10' author: Michael Haag, Teoderick Contreras, Splunk status: production @@ -21,10 +21,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" - OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`' + OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `windows_execute_arbitrary_commands_with_msdt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -89,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml index 2b92a1ae16..e0d85eea50 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml @@ -1,6 +1,6 @@ name: Windows Exfiltration Over C2 Via Invoke RestMethod id: 06ade821-f6fa-40d0-80af-15bc1d45b3ba -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,9 @@ description: The following analytic detects potential data exfiltration using Po intent and scope of the activity. search: '`powershell` EventCode=4104 ScriptBlockText = "*Invoke-RestMethod *" AND ScriptBlockText = "* -Uri *" AND ScriptBlockText = "* -Method *" AND ScriptBlockText - = "* Post *" AND ScriptBlockText = "* -InFile *" | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` + = "* Post *" AND ScriptBlockText = "* -InFile *" | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product + EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_exfiltration_over_c2_via_invoke_restmethod_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -42,10 +43,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A PowerShell script on $Computer$ is attempting to transfer files to a - remote URL. + message: A PowerShell script on $dest$ is attempting to transfer files to a remote + URL. risk_objects: - - field: Computer + - field: dest type: system score: 49 threat_objects: [] @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml index 1a2c2061cf..20cb8a0f11 100644 --- a/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml +++ b/detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml @@ -1,6 +1,6 @@ name: Windows Exfiltration Over C2 Via Powershell UploadString id: 59e8bf41-7472-412a-90d3-00f3afa452e9 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic identifies potential data exfiltration using data transfer, compromising sensitive information and potentially leading to further exploitation of the compromised host. search: '`powershell` EventCode=4104 ScriptBlockText = "*Net.webclient*" AND ScriptBlockText - = "*.UploadString*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` + = "*.UploadString*" | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_exfiltration_over_c2_via_powershell_uploadstring_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -41,10 +42,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A PowerShell script on $Computer$ is attempting to transfer files to a - remote URL. + message: A PowerShell script on $dest$ is attempting to transfer files to a remote + URL. risk_objects: - - field: Computer + - field: dest type: system score: 49 threat_objects: [] @@ -62,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml b/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml index ba9c6cbaf4..a989e415a8 100644 --- a/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml +++ b/detections/endpoint/windows_explorer_lnk_exploit_process_launch_with_padding.yml @@ -12,12 +12,15 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\explorer.exe" (Processes.process_path="*\\cmd.exe" OR Processes.process_path="*\\powershell.exe") - by Processes.dest Processes.process_current_directory Processes.process_path Processes.process Processes.original_file_name Processes.parent_process Processes.parent_process_name Processes.parent_process_path - Processes.parent_process_guid Processes.parent_process_id Processes.process_guid - Processes.process_id Processes.user - | `drop_dm_object_name(Processes)` - | regex process=".*?\s{50,}.*" - | `windows_explorer_lnk_exploit_process_launch_with_padding_filter`' + by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | regex process=".*?\s{50,}.*" + | `windows_explorer_lnk_exploit_process_launch_with_padding_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some legitimate user actions may trigger Explorer.exe to spawn PowerShell or cmd.exe, such as right-clicking and selecting "Open PowerShell window here" or similar options. Filter as needed based on your environment's normal behavior patterns. Reduce or increase the padding threshold based on observed false positives. references: diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml index 31f3eb0a66..f2c8751fd9 100644 --- a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml +++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml @@ -1,6 +1,6 @@ name: Windows File and Directory Enable ReadOnly Permissions id: 1ae407b0-a042-4eb0-834a-590da055575e -version: 1 +version: 2 date: '2024-12-13' author: Teoderick Contreras, Splunk data_source: @@ -8,20 +8,38 @@ data_source: - Windows Event Log Security 4688 type: TTP status: production -description: The following analytic detects instances where file or folder permissions are modified to grant read-only access. Such changes are characterized by the presence of read-related permissions (e.g., R, REA, RA, RD) and the absence of write (W) or execute (E) permissions. Monitoring these events is crucial for tracking access control changes that could be intentional for restricting access or indicative of malicious behavior. Alerts generated by this detection help ensure that legitimate security measures are enforced while unauthorized changes are promptly investigated. -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") AND Processes.process IN ("*SYSTEM*", "*admin*", "*S-1-1-0*", "*EVERYONE*") - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | rex field=process ":\\((?[^)]+)\\)" - | eval has_read_attribute=if(match(permission, "R"), "true", "false") - | eval has_write_execute=if(match(permission, "(W|GA|X|M|F|AD|DC|DE)"), "true", "false") - | where has_write_execute="false" and has_read_attribute = "true" - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic detects instances where file or folder permissions + are modified to grant read-only access. Such changes are characterized by the presence + of read-related permissions (e.g., R, REA, RA, RD) and the absence of write (W) + or execute (E) permissions. Monitoring these events is crucial for tracking access + control changes that could be intentional for restricting access or indicative of + malicious behavior. Alerts generated by this detection help ensure that legitimate + security measures are enforced while unauthorized changes are promptly investigated. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", + "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") AND Processes.process + IN ("*SYSTEM*", "*admin*", "*S-1-1-0*", "*EVERYONE*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | rex field=process ":\\((?[^)]+)\\)" + | eval has_read_attribute=if(match(permission, "R"), "true", "false") | eval has_write_execute=if(match(permission, + "(W|GA|X|M|F|AD|DC|DE)"), "true", "false") | where has_write_execute="false" and + has_read_attribute = "true" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_enable_readonly_permissions_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. + Filter as needed. references: - https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html drilldown_searches: @@ -30,11 +48,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$process_name$] was executed on [$dest$] attempting to change the access to a file or directory into readonly permissions. + message: A [$process_name$] was executed on [$dest$] attempting to change the access + to a file or directory into readonly permissions. risk_objects: - field: dest type: system @@ -58,4 +82,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml index 71b96e2add..e448025f50 100644 --- a/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml +++ b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml @@ -1,6 +1,6 @@ name: Windows File and Directory Permissions Enable Inheritance id: 0247f90a-aca4-47b2-a94d-e30f445d7b41 -version: 1 +version: 2 date: '2024-12-13' author: Teoderick Contreras, Splunk data_source: @@ -8,16 +8,35 @@ data_source: - Windows Event Log Security 4688 type: Hunting status: production -description: The following analytic detects the enabling of permission inheritance using ICACLS. This analytic identifies instances where ICACLS commands are used to enable permission inheritance on files or directories. The /inheritance:e flag, which restores inherited permissions from a parent directory, is monitored to detect changes that might reapply broader access control settings. Enabling inheritance can indicate legitimate administrative actions but may also signal attempts to override restrictive custom permissions, potentially exposing sensitive files to unauthorized access. -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:e*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic detects the enabling of permission inheritance + using ICACLS. This analytic identifies instances where ICACLS commands are used + to enable permission inheritance on files or directories. The /inheritance:e flag, + which restores inherited permissions from a parent directory, is monitored to detect + changes that might reapply broader access control settings. Enabling inheritance + can indicate legitimate administrative actions but may also signal attempts to override + restrictive custom permissions, potentially exposing sensitive files to unauthorized + access. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", + "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:e*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_permissions_enable_inheritance_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. + Filter as needed. references: - https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html drilldown_searches: @@ -26,7 +45,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: diff --git a/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml index 8c8d1cbacf..e3e4e76958 100644 --- a/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml +++ b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml @@ -1,6 +1,6 @@ name: Windows File and Directory Permissions Remove Inheritance id: 9b62da2c-e442-474f-83ca-fac4dabab1b3 -version: 1 +version: 2 date: '2024-12-13' author: Teoderick Contreras, Splunk data_source: @@ -8,16 +8,35 @@ data_source: - Windows Event Log Security 4688 type: Anomaly status: production -description: The following analytic detects the removal of permission inheritance using ICACLS. This analytic identifies instances where ICACLS is used to remove permission inheritance from files or directories. The /inheritance:r flag, which strips inherited permissions while optionally preserving or altering explicit permissions, is monitored to detect changes that may restrict access or establish isolated permission configurations. Removing inheritance can be a legitimate administrative action but may also indicate an attempt to conceal malicious activity or bypass inherited security controls. -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:r*" - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic detects the removal of permission inheritance + using ICACLS. This analytic identifies instances where ICACLS is used to remove + permission inheritance from files or directories. The /inheritance:r flag, which + strips inherited permissions while optionally preserving or altering explicit permissions, + is monitored to detect changes that may restrict access or establish isolated permission + configurations. Removing inheritance can be a legitimate administrative action but + may also indicate an attempt to conceal malicious activity or bypass inherited security + controls. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", + "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:r*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_permissions_remove_inheritance_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. + Filter as needed. references: - https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html drilldown_searches: @@ -26,11 +45,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$process_name$] was executed on [$dest$] attempting to remove inheritance permissions. + message: A [$process_name$] was executed on [$dest$] attempting to remove inheritance + permissions. risk_objects: - field: dest type: system @@ -54,4 +79,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index 344bcb30ed..a398d502d6 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -1,6 +1,6 @@ name: Windows File Share Discovery With Powerview id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk type: TTP @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the Invoke-ShareFin If confirmed malicious, this activity could enable an attacker to escalate privileges or move laterally within the network, potentially compromising additional systems and sensitive data. -search: '`powershell` EventCode=4104 (ScriptBlockText=Invoke-ShareFinder*) | stats - count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | rename UserID as user | rename Computer as dest | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `windows_file_share_discovery_with_powerview_filter`' +search: '`powershell` EventCode=4104 (ScriptBlockText=Invoke-ShareFinder*) | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_share_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.= @@ -29,13 +29,13 @@ references: - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ - https://attack.mitre.org/techniques/T1135/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -48,7 +48,7 @@ rba: - field: dest type: system score: 48 - - field: user + - field: user_id type: user score: 48 threat_objects: [] @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml index cbe465f6fb..368ef79547 100644 --- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -1,6 +1,6 @@ name: Windows File Transfer Protocol In Non-Common Process Path id: 0f43758f-1fe9-470a-a9e4-780acc4d5407 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,10 @@ data_source: - Sysmon EventID 3 search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\windows\\system32\\*","*\\windows\\SysWOW64\\*")) (DestinationPortName="ftp" OR DestinationPort=21) | stats count min(_time) as firstTime - max(_time) as lastTime by Image DestinationPort DestinationPortName DestinationHostname - DestinationIp SourcePort SourcePortName Protocol SourceHostname dest user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_file_transfer_protocol_in_non_common_process_path_filter`' + max(_time) as lastTime by action app dest dest_ip dest_port direction dvc protocol + protocol_version src src_ip src_port transport user vendor_product process_name + process_exec process_guid process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_file_transfer_protocol_in_non_common_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -43,8 +44,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a process $Image$ is having a FTP connection to $DestinationHostname$ in - $dest$ + message: a process $process_name$ is having a FTP connection to $dest$ in $dest_ip$ risk_objects: - field: dest type: system @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_ftp/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_ftp/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index 256673d3f1..8f52079b68 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -1,6 +1,6 @@ name: Windows File Without Extension In Critical Folder id: 0dbcac64-963c-11ec-bf04-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Bhavin Patel, Splunk status: production @@ -13,18 +13,15 @@ description: The following analytic detects the creation of files without extens could lead to severe system compromise, including boot sector wiping, resulting in potential data loss and system inoperability. data_source: -- Sysmon EventID 1 AND Sysmon EventID 11 +- Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") - by _time span=5m Filesystem.dest Filesystem.user Filesystem.file_name Filesystem.file_path - Filesystem.process_guid Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` - | rex field="file_name" "\.(?[^\.]*$)" | where isnull(extension) | join - process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=5m Processes.process_name Processes.dest Processes.process_guid Processes.user - | `drop_dm_object_name(Processes)`] | stats count min(_time) as firstTime max(_time) - as lastTime by dest process_name process_guid file_name file_path file_create_time - user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_file_without_extension_in_critical_folder_filter`' + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + rex field="file_name" "\.(?[^\.]*$)" | where isnull(extension) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -67,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index 356e3e7925..7d06b70b11 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -1,6 +1,6 @@ name: Windows Files and Dirs Access Rights Modification Via Icacls id: c76b796c-27e1-4520-91c4-4a58695c749e -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ description: The following analytic identifies the modification of security perm search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", "cacls.exe","xcacls.exe") AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",, - "*:N*","*/P*", "*/E*") by Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`' + "*:N*","*/P*", "*/E*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/amadey/access_permission/amadey_sysmon2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/amadey/access_permission/amadey_sysmon2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index dd165dc33e..69f5de75bd 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -1,6 +1,6 @@ name: Windows Find Domain Organizational Units with GetDomainOU id: 0ada2f82-b7af-40cc-b1d7-1e5985afcb4e -version: 5 +version: 6 date: '2025-02-10' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the `Get-DomainOU` movement or privilege escalation. If confirmed malicious, this activity could allow attackers to map the domain structure, aiding in further exploitation and persistence within the network. -search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer - UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_find_domain_organizational_units_with_getdomainou_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_domain_organizational_units_with_getdomainou_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -29,13 +29,13 @@ references: - https://attack.mitre.org/techniques/T1087/002/ - https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -44,12 +44,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Suspicious PowerShell Get-DomainOU was identified on endpoint $dest$ by - user $user$. + user $user_id$. risk_objects: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-DomainOU-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-DomainOU-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index ffed352753..58f395abfe 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -1,6 +1,6 @@ name: Windows Find Interesting ACL with FindInterestingDomainAcl id: e4a96dfd-667a-4487-b942-ccef5a1e81e8 -version: 5 +version: 6 date: '2025-02-10' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the execution of the `Find-Interesti to identify privilege escalation opportunities or weak security configurations in Active Directory, potentially leading to unauthorized access or further exploitation. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -28,13 +29,13 @@ references: - https://attack.mitre.org/techniques/T1087/002/ - https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -43,12 +44,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint - $dest$ by user $user$. + $dest$ by user $user_id$. risk_objects: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-interestingACL-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-interestingACL-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml index 2ce7f83865..e9f8deef4f 100644 --- a/detections/endpoint/windows_findstr_gpp_discovery.yml +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -1,6 +1,6 @@ name: Windows Findstr GPP Discovery id: 1631ac2d-f2a9-42fa-8a59-d6e210d472f5 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk type: TTP @@ -19,10 +19,13 @@ description: The following analytic detects the use of the findstr command to se systems and data within the domain. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=findstr.exe - AND Processes.process=*sysvol* AND Processes.process=*cpassword*) by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.original_file_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + AND Processes.process=*sysvol* AND Processes.process=*cpassword*) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_findstr_gpp_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index c8bcb30a51..d195ac6452 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -1,6 +1,6 @@ name: Windows Forest Discovery with GetForestDomain id: a14803b2-4bd9-4c08-8b57-c37980edebe8 -version: 5 +version: 6 date: '2025-02-10' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production @@ -14,10 +14,10 @@ description: The following analytic detects the execution of the `Get-ForestDoma it to gather detailed information about Active Directory forest and domain configurations. If confirmed malicious, this activity could enable attackers to understand the domain structure, facilitating lateral movement or privilege escalation within the environment. -search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_forest_discovery_with_getforestdomain_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_forest_discovery_with_getforestdomain_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -43,12 +43,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Suspicious PowerShell Get-ForestDomain was identified on endpoint $dest$ - by user $user$. + by user $user_id$. risk_objects: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-ForestDomain-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-ForestDomain-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_gather_victim_host_information_camera.yml b/detections/endpoint/windows_gather_victim_host_information_camera.yml index 9bf473e971..ae137132ae 100644 --- a/detections/endpoint/windows_gather_victim_host_information_camera.yml +++ b/detections/endpoint/windows_gather_victim_host_information_camera.yml @@ -1,6 +1,6 @@ name: Windows Gather Victim Host Information Camera id: e4df4676-ea41-4397-b160-3ee0140dc332 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,10 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText - IN ("*Image*", "*Camera*") | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer UserID | rename Computer as dest | rename - UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_gather_victim_host_information_camera_filter`' + IN ("*Image*", "*Camera*") | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_gather_victim_host_information_camera_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -30,13 +30,13 @@ references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -49,7 +49,7 @@ rba: - field: dest type: system score: 42 - - field: user + - field: user_id type: user score: 42 threat_objects: [] @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_gather_victim_identity_sam_info.yml b/detections/endpoint/windows_gather_victim_identity_sam_info.yml index 783965ba95..cdacf4908b 100644 --- a/detections/endpoint/windows_gather_victim_identity_sam_info.yml +++ b/detections/endpoint/windows_gather_victim_identity_sam_info.yml @@ -1,6 +1,6 @@ name: Windows Gather Victim Identity SAM Info id: a18e85d7-8b98-4399-820c-d46a1ca3516f -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,12 @@ data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 (ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL") - AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats - count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name - dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_gather_victim_identity_sam_info_filter`' + AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded + dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash + process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_gather_victim_identity_sam_info_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. @@ -42,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/loading_samlib/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml index 6f3bc7bea2..b34691a945 100644 --- a/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml +++ b/detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml @@ -1,6 +1,6 @@ name: Windows Get-AdComputer Unconstrained Delegation Discovery id: c8640777-469f-4638-ab44-c34a3233ffac -version: 6 +version: 7 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the use of the Get-ADComputer cmdlet data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-ADComputer*" AND ScriptBlockText - = "*TrustedForDelegation*") | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest - | rename UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_get_adcomputer_unconstrained_delegation_discovery_filter`' + = "*TrustedForDelegation*") | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_get_adcomputer_unconstrained_delegation_discovery_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -32,13 +32,13 @@ references: - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation - https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -51,7 +51,7 @@ rba: - field: dest type: system score: 35 - - field: user + - field: user_id type: user score: 35 threat_objects: [] @@ -69,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 79e2ef2681..8172983947 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -1,6 +1,6 @@ name: Windows Get Local Admin with FindLocalAdminAccess id: d2988160-3ce9-4310-b59d-905334920cdd -version: 5 +version: 6 date: '2025-02-10' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production @@ -16,9 +16,10 @@ description: The following analytic detects the execution of the `Find-LocalAdmi additional systems within the network, significantly increasing their control and access to sensitive information. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" | - stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_get_local_admin_with_findlocaladminaccess_filter`' + fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature + signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId + ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_get_local_admin_with_findlocaladminaccess_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -29,13 +30,13 @@ references: - https://attack.mitre.org/techniques/T1087/002/ - https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -44,12 +45,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: Suspicious PowerShell Find-LocalAdminAccess was identified on endpoint - $dest$ by user $user$. + $dest$ by user $user_id$. risk_objects: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-LocalAdminAccess-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-LocalAdminAccess-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml b/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml index 46c7c7e9f9..004fa3e7ee 100644 --- a/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml +++ b/detections/endpoint/windows_global_object_access_audit_list_cleared_via_auditpol.yml @@ -1,18 +1,44 @@ name: Windows Global Object Access Audit List Cleared Via Auditpol id: 802a0930-0a4a-4451-bf6c-6366c6b6d9e7 -version: 1 +version: 2 date: '2025-01-27' author: Nasreddine Bencherchali, Splunk status: production type: TTP -description: The following analytic identifies the execution of `auditpol.exe` with the "/resourceSACL" flag, and either the "/clear" or "/remove" command-line arguments used to remove or clear the global object access audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement. +description: The following analytic identifies the execution of `auditpol.exe` with + the "/resourceSACL" flag, and either the "/clear" or "/remove" command-line arguments + used to remove or clear the global object access audit policy. It leverages data + from Endpoint Detection and Response (EDR) agents, focusing on process names and + command-line executions. This activity can be significant as it indicates potential + defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged + for detections and audits. If confirmed malicious, this behavior could allow attackers + to bypass defenses, and plan further attacks, potentially leading to full machine + compromise or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process="*/resourceSACL*" Processes.process IN ("*/clear*", "*/remove*") AND NOT Processes.process="*/?*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_global_object_access_audit_list_cleared_via_auditpol_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process name, and process original file name. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives should be rare to non existent. Any activity detected by this analytic should be investigated and approved or denied. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_auditpol` Processes.process="*/resourceSACL*" + Processes.process IN ("*/clear*", "*/remove*") AND NOT Processes.process="*/?*" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_global_object_access_audit_list_cleared_via_auditpol_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process name, and process original file name. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives should be rare to non existent. Any activity + detected by this analytic should be investigated and approved or denied. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-resourcesacl drilldown_searches: @@ -30,7 +56,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to clear the global object access audit policy on endpoint $dest$ by user $user$. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to clear the global object access audit policy on endpoint $dest$ by + user $user$. risk_objects: - field: user type: user @@ -55,13 +83,11 @@ tags: tests: - name: True Positive Test - Sysmon attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test - Security attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml index bd02d34030..822ec47bdc 100644 --- a/detections/endpoint/windows_group_discovery_via_net.yml +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -1,6 +1,6 @@ name: Windows Group Discovery Via Net id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 -version: 2 +version: 3 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" - AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_group_discovery_via_net_filter`' + AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_group_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -63,13 +67,11 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_group_policy_object_created.yml b/detections/endpoint/windows_group_policy_object_created.yml index bd4406e610..6709762ab5 100644 --- a/detections/endpoint/windows_group_policy_object_created.yml +++ b/detections/endpoint/windows_group_policy_object_created.yml @@ -1,6 +1,6 @@ name: Windows Group Policy Object Created id: 23add2a8-ea22-4fd4-8bc0-8c0b822373a1 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco status: production @@ -18,8 +18,9 @@ description: The following analytic detects the creation of a new Group Policy O search: '`wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer | stats values(AttributeValue) as details values(SubjectUserSid) - as User values(ObjectDN) as ObjectDN by ObjectGUID Computer | eval GPO_Name = mvindex(details, - 0) | eval GPO_Path = mvindex(details, 1) | fields - details | `windows_group_policy_object_created_filter`' + as User values(ObjectDN) as ObjectDN by ObjectGUID Computer dest | eval GPO_Name + = mvindex(details, 0) | eval GPO_Path = mvindex(details, 1) | fields - details | + `windows_group_policy_object_created_filter`' how_to_implement: To successfully implement this search, the Advanced Security Audit policy setting `Audit Directory Service Changes` within `DS Access` needs to be enabled. Furthermore, the appropriate system access control lists (SACL) need to @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/group_policy_created/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 6862dc0375..a9519424e9 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -1,6 +1,6 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 -version: 8 +version: 9 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,9 +17,10 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", - "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") BY - _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid + "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") by + Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index 93778f82a0..688f641db0 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -1,7 +1,7 @@ name: Windows High File Deletion Frequency id: 45b125c4-866f-11eb-a95a-acde48001122 -version: '6' -date: '2025-03-03' +version: 7 +date: '2025-03-27' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -19,10 +19,13 @@ search: '`sysmon` EventCode IN ("23","26") TargetFilename IN ("*.cmd", "*.ini"," "*.jpg", "*.jpeg", "*.db", "*.ps1", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx", "*.bmp","*.zip", "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf" , "*.backup*", "*.dsk", "*.win") NOT - TargetFilename IN ("*\\INetCache\\Content.Outlook\\*") | stats count, values(TargetFilename) - as deleted_files, min(_time) as firstTime, max(_time) as lastTime by user, dest, - signature, signature_id, Image, process_name, process_guid | rename Image as process - | where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + TargetFilename IN ("*\\INetCache\\Content.Outlook\\*") | stats count min(_time) + as firstTime, max(_time) as lastTime values(file_path) as file_path values(file_hash) + as file_hash values(file_name) as file_name values(file_modify_time) as file_modify_time + values(process_name) as process_name values(process_path) as process_path values(process_guid) + as process_guid values(process_id) as process_id values(process_exec) as process_exec + by action dest dvc signature signature_id user user_id vendor_product | where count + >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`' how_to_implement: To successfully implement this search, you need to ingest logs that include the deleted target file name, process name, and process ID from your endpoints. @@ -59,8 +62,6 @@ rba: type: system score: 72 threat_objects: - - field: deleted_files - type: file_name - field: process_name type: process_name tags: diff --git a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml index 20958cf465..164fe89a69 100644 --- a/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml +++ b/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml @@ -1,6 +1,6 @@ name: Windows Hijack Execution Flow Version Dll Side Load id: 8351340b-ac0e-41ec-8b07-dd01bf32d6ea -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,12 @@ description: The following analytic detects a process loading a version.dll file data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 ImageLoaded = "*\\version.dll" AND (Signed = "false" - OR NOT(ImageLoaded IN("*\\windows\\system32*", "*\\windows\\syswow64\\*"))) | stats - count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name - dest EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_hijack_execution_flow_version_dll_side_load_filter`' + OR NOT(ImageLoaded IN("*\\windows\\system32*", "*\\windows\\syswow64\\*"))) | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded + dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash + process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_hijack_execution_flow_version_dll_side_load_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. @@ -61,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index d312721aa7..28adb5c2ad 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -1,15 +1,60 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 -version: 2 +version: 3 date: '2025-01-17' author: Michael Haag, Splunk status: production type: Anomaly -description: The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment. +description: The following analytic detects MSIExec making network connections over + ports 443 or 80. This behavior is identified by correlating process creation events + from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, + MSIExec does not perform network communication to the internet, making this activity + unusual and potentially indicative of malicious behavior. If confirmed malicious, + an attacker could be using MSIExec to download or communicate with external servers, + potentially leading to data exfiltration, command and control (C2) communication, + or further malware deployment. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] | table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip | `windows_http_network_communication_from_msiexec_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_msiexec` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where + All_Traffic.dest_port IN ("80","443") by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_http_network_communication_from_msiexec_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: False positives will be present and filtering is required. references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ @@ -20,7 +65,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml index f839a81cb1..f1a6084c62 100644 --- a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml @@ -1,6 +1,6 @@ name: Windows Hunting System Account Targeting Lsass id: 1c6abb08-73d1-11ec-9ca0-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,9 +15,12 @@ description: The following analytic identifies processes attempting to access Ls data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) as - firstTime max(_time) as lastTime by dest, TargetImage, GrantedAccess, SourceImage, - SourceProcessId, SourceUser, TargetUser | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`' + firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode + ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID + TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process_exec process_guid + process_id process_name process_path signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -46,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index f6b47a5ac9..399aa24885 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -1,6 +1,6 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,11 +18,15 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) - as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.parent_process_name - Processes.user Processes.process_name Processes.process | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup - windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" - | `windows_identify_protocol_handlers_filter`' + as parent_process from datamodel=Endpoint.Processes by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` + | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | + where ishandler="TRUE" | `windows_identify_protocol_handlers_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -58,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index b8e4617559..a4d78bed01 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -1,6 +1,6 @@ name: Windows IIS Components Add New Module id: 38fe731c-1f13-43d4-b878-a5bbe44807e3 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("msiexec.exe", "iissetup.exe")) Processes.process_name=appcmd.exe Processes.process - IN ("*install *", "*module *") AND Processes.process="*image*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iis_components_add_new_module_filter`' + IN ("*install *", "*module *") AND Processes.process="*image*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_iis_components_add_new_module_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml index 9b97d2d1cf..8b92995704 100644 --- a/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml +++ b/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Add Xml Applocker Rules id: 467ed9d9-8035-470e-ad5e-ae5189283033 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` AND Processes.process="*Import-Module Applocker*" AND Processes.process="*Set-AppLockerPolicy *" AND Processes.process="* -XMLPolicy - *" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_add_xml_applocker_rules_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -51,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml b/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml index ae3ea75104..ad8099b7db 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_health_check_intervals.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Change Win Defender Health Check Intervals id: 5211c260-820e-4366-b983-84bbfb5c263a -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects modifications to the Windows registr of undetected malware or other malicious activities. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows - Defender\\ServiceKeepAlive" Registry.registry_value_data="0x00000001" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_health_check_intervals_filter`' + Defender\\ServiceKeepAlive" Registry.registry_value_data="0x00000001" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_change_win_defender_health_check_intervals_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml b/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml index 8be748c8ae..4e0979fdcb 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Change Win Defender Quick Scan Interval id: 783f0798-f679-4c17-b3b3-187febf0b9b8 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ description: The following analytic detects modifications to the Windows registr activities without being detected by quick scans. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows - Defender\\Scan\\QuickScanInterval" by Registry.registry_key_name Registry.user Registry.registry_path - Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` + Defender\\Scan\\QuickScanInterval" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_quick_scan_interval_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml b/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml index dabde75de8..1369ba7093 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_throttle_rate.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Change Win Defender Throttle Rate id: f7da5fca-9261-43de-a4d0-130dad1e4f4d -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects modifications to the ThrottleDetecti and forensic investigations. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows - Defender\\NIS\\Consumers\\IPS\\ThrottleDetectionEventsRate" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_throttle_rate_filter`' + Defender\\NIS\\Consumers\\IPS\\ThrottleDetectionEventsRate" by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_change_win_defender_throttle_rate_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml b/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml index 1940d97bad..d24a8027ff 100644 --- a/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml +++ b/detections/endpoint/windows_impair_defense_change_win_defender_tracing_level.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Change Win Defender Tracing Level id: fe9391cd-952a-4c64-8f56-727cb0d4f2d4 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\WppTracingLevel" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_change_win_defender_tracing_level_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_change_win_defender_tracing_level_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_configure_app_install_control.yml b/detections/endpoint/windows_impair_defense_configure_app_install_control.yml index 520eb1d524..3d2424ebc0 100644 --- a/detections/endpoint/windows_impair_defense_configure_app_install_control.yml +++ b/detections/endpoint/windows_impair_defense_configure_app_install_control.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Configure App Install Control id: c54b7439-cfb1-44c3-bb35-b0409553077c -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows Defender\\SmartScreen\\ConfigureAppInstallControl" Registry.registry_value_data= "Anywhere") OR (Registry.registry_path= "*\\Microsoft\\Windows Defender\\SmartScreen\\ConfigureAppInstallControlEnabled" - Registry.registry_value_data= "0x00000000") BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_configure_app_install_control_filter`' + Registry.registry_value_data= "0x00000000") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_configure_app_install_control_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -70,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml b/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml index eeea89b42b..dbb3348739 100644 --- a/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml +++ b/detections/endpoint/windows_impair_defense_define_win_defender_threat_action.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Define Win Defender Threat Action id: 7215831c-8252-4ae3-8d43-db588e82f952 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows Defende search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Threats\\ThreatSeverityDefaultAction*" Registry.registry_value_data IN - ("0x00000001", "9") by Registry.registry_key_name Registry.user Registry.registry_path - Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_define_win_defender_threat_action_filter`' + ("0x00000001", "9") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defense_define_win_defender_threat_action_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml index 61233509f4..9db3e963e3 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Delete Win Defender Context Menu id: 395ed5fe-ad13-4366-9405-a228427bdd91 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\shellex\\ContextMenuHandlers\\EPP" - Registry.action = deleted by Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.action Registry.dest - Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_context_menu_filter`' + Registry.action = deleted by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_context_menu_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -46,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml index b61e775811..0ecfe0c238 100644 --- a/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml +++ b/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Delete Win Defender Profile Registry id: 65d4b105-ec52-48ec-ac46-289d0fbf7d96 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows - Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.action Registry.user - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`' + Defender" Registry.action = deleted by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml index ed9a0e98fd..cfa1c4c586 100644 --- a/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml +++ b/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Deny Security Software With Applocker id: e0b6ca60-9e29-4450-b51a-bba0abae2313 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -23,8 +23,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", - "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by Registry.user Registry.registry_path - Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest + "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_deny_security_software_with_applocker_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml b/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml index ddbb6949be..4d02c7f510 100644 --- a/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml +++ b/detections/endpoint/windows_impair_defense_disable_controlled_folder_access.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Controlled Folder Access id: 3032741c-d6fc-4c69-8988-be8043d6478c -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,11 @@ description: The following analytic detects a modification in the Windows regist search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess" - Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_impair_defense_disable_controlled_folder_access_filter`' + Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_controlled_folder_access_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml b/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml index ca7a595913..4660fd97f1 100644 --- a/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml +++ b/detections/endpoint/windows_impair_defense_disable_defender_firewall_and_network.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Defender Firewall And Network id: 8467d8cd-b0f9-46fa-ac84-a30ad138983e -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications in the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender Security Center\\Firewall and network protection\\UILockdown" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_firewall_and_network_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_defender_firewall_and_network_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml b/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml index a27b36b355..519a9933ce 100644 --- a/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml +++ b/detections/endpoint/windows_impair_defense_disable_defender_protocol_recognition.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Defender Protocol Recognition id: b2215bfb-6171-4137-af17-1a02fdd8d043 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\NIS\\DisableProtocolRecognition" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_defender_protocol_recognition_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_defender_protocol_recognition_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml index 2a8593ec20..9cca136052 100644 --- a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml +++ b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable PUA Protection id: fbfef407-cfee-4866-88c1-f8de1c16147c -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects a modification in the Windows regist other unwanted software, potentially compromising system integrity and user productivity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows - Defender\\PUAProtection" Registry.registry_value_data="0x00000000" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_pua_protection_filter`' + Defender\\PUAProtection" Registry.registry_value_data="0x00000000" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_pua_protection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml index 88bf6f9a86..858752c29e 100644 --- a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml +++ b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Realtime Signature Delivery id: ffd99aea-542f-448e-b737-091c1b417274 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\RealtimeSignatureDelivery" Registry.registry_value_data="0x00000000" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_realtime_signature_delivery_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_realtime_signature_delivery_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml index 8b712c09ed..8d34f2c916 100644 --- a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml +++ b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Web Evaluation id: e234970c-dcf5-4f80-b6a9-3a562544ca5b -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ description: The following analytic detects modifications to the Windows registr the risk of system exploitation and security breaches. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation" Registry.registry_value_data= - "0x00000000" BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_impair_defense_disable_web_evaluation_filter`' + "0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_web_evaluation_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml index 2bf4a14a56..8f3b0cf42b 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Win Defender App Guard id: 8b700d7e-54ad-4d7d-81cc-1456c4703306 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ description: The following analytic detects modifications to the Windows registr data exfiltration, or further system compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Policies\\Microsoft\\AppHVSI\\AuditApplicationGuard" - Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_impair_defense_disable_win_defender_app_guard_filter`' + Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_app_guard_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml index dac586e78e..8b6a3ed627 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Win Defender Compute File Hashes id: fe52c280-98bd-4596-b6f6-a13bbf8ac7c6 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\MpEngine\\EnableFileHashComputation" Registry.registry_value_data="0x00000000" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_compute_file_hashes_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_compute_file_hashes_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml index eb6fab38e2..f948d8c4cd 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Win Defender Gen reports id: 93f114f6-cb1e-419b-ac3f-9e11a3045e70 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications in the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\DisableGenericRePorts" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_gen_reports_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_gen_reports_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml index b14aef2225..8855ecf14e 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Win Defender Network Protection id: 8b6c15c7-5556-463d-83c7-986326c21f12 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection" - Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_impair_defense_disable_win_defender_network_protection_filter`' + Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_network_protection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml index 76d45778ef..7ca5ecee6b 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_report_infection.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Win Defender Report Infection id: 201946c6-b1d5-42bb-a7e0-5f7123f47fc4 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ description: The following analytic detects modifications to the Windows registr prolonged unauthorized access and potential data breaches. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\MRT\\DontReportInfectionInformation" - Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_impair_defense_disable_win_defender_report_infection_filter`' + Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_report_infection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml index 9ab5fddb36..1257b43b23 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_scan_on_update.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Win Defender Scan On Update id: 0418e72f-e710-4867-b656-0688e1523e09 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\DisableScanOnUpdate" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_scan_on_update_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_scan_on_update_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml index b047489ba8..caf53d3875 100644 --- a/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_signature_retirement.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Disable Win Defender Signature Retirement id: 7567a72f-bada-489d-aef1-59743fb64a66 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\NIS\\Consumers\\IPS\\DisableSignatureRetirement" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_disable_win_defender_signature_retirement_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_signature_retirement_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml b/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml index 5938e97657..c1d0ad92d7 100644 --- a/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml +++ b/detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Overide Win Defender Phishing Filter id: 10ca081c-57b1-4a78-ba56-14a40a7e116a -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,12 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_key_name = "*\\MicrosoftEdge\\PhishingFilter" Registry.registry_value_name IN ("EnabledV9", - "PreventOverride") Registry.registry_value_data="0x00000000" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_overide_win_defender_phishing_filter_filter`' + "PreventOverride") Registry.registry_value_data="0x00000000" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_impair_defense_overide_win_defender_phishing_filter_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml b/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml index 50c0ed32ea..b1ab3a8839 100644 --- a/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml +++ b/detections/endpoint/windows_impair_defense_override_smartscreen_prompt.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Override SmartScreen Prompt id: 08058866-7987-486f-b042-275715ef6e9d -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ description: The following analytic detects modifications to the Windows registr incidents or system compromises. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Microsoft\\Edge\\PreventSmartScreenPromptOverride" - Registry.registry_value_data= "0x00000000" BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defense_override_smartscreen_prompt_filter`' + Registry.registry_value_data= "0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_override_smartscreen_prompt_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml b/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml index 23323473d6..de521b8e3d 100644 --- a/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml +++ b/detections/endpoint/windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml @@ -1,6 +1,6 @@ name: Windows Impair Defense Set Win Defender Smart Screen Level To Warn id: cc2a3425-2703-47e7-818f-3dca1b0bc56f -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ description: The following analytic detects modifications to the Windows registr risk of successful malware deployment and subsequent system compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\System\\ShellSmartScreenLevel" - Registry.registry_value_data="Warn" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_impair_defense_set_win_defender_smart_screen_level_to_warn_filter`' + Registry.registry_value_data="Warn" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_set_win_defender_smart_screen_level_to_warn_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml index 1220aac4a3..c842b5bdda 100644 --- a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml +++ b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml @@ -1,6 +1,6 @@ name: Windows Impair Defenses Disable Auto Logger Session id: dc6a5613-d024-47e7-9997-ab6477a483d3 -version: 3 +version: 4 date: '2025-02-10' author: Nasreddine Bencherchali, Splunk status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\WMI\\Autologger\\*" (Registry.registry_value_name="Start" OR Registry.registry_value_name="Enabled") - Registry.registry_value_data ="0x00000000" by Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.action Registry.dest - Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_auto_logger_session_filter`' + Registry.registry_value_data ="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_auto_logger_session_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml index 0499d7e3de..1f19b89ae5 100644 --- a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml +++ b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml @@ -1,6 +1,6 @@ name: Windows Impair Defenses Disable AV AutoStart via Registry id: 31a13f43-812e-4752-a6ca-c6c87bf03e83 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: @@ -21,9 +21,10 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint "*\\kingsoft\\antivirus\\Windhunter\\*" ,"*\\Tencent\\QQPCMgr\\*") AND ((Registry.registry_value_name IN("autostart","kxesc", "WindhunterSwitch") AND Registry.registry_value_data = "0x00000000") OR (Registry.registry_value_name = "WindhunterLevel" AND Registry.registry_value_data - = "0x00000004")) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.registry_hive - Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + = "0x00000004")) by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_av_autostart_via_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml index 68ca010e45..0bf147f3c4 100644 --- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -1,6 +1,6 @@ name: Windows Impair Defenses Disable HVCI id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,10 +16,11 @@ description: The following analytic detects the disabling of Hypervisor-protecte leading to kernel-level rootkits or other severe security breaches. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled" - Registry.registry_value_data="0x00000000" by Registry.registry_path Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.action Registry.user - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`' + Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_hvci_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml index 4faf3a1895..f865b69ace 100644 --- a/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml +++ b/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml @@ -1,6 +1,6 @@ name: Windows Impair Defenses Disable Win Defender Auto Logging id: 76406a0f-f5e0-4167-8e1f-337fdc0f1b0c -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path = "*WMI\\Autologger\\DefenderApiLogger\\Start" OR Registry.registry_path = "*WMI\\Autologger\\DefenderAuditLogger\\Start") Registry.registry_value_data - ="0x00000000" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.action Registry.dest Registry.user | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' + ="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_impair_defenses_disable_win_defender_auto_logging_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. @@ -70,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/application/windows_increase_in_group_or_object_modification_activity.yml b/detections/endpoint/windows_increase_in_group_or_object_modification_activity.yml similarity index 100% rename from detections/application/windows_increase_in_group_or_object_modification_activity.yml rename to detections/endpoint/windows_increase_in_group_or_object_modification_activity.yml diff --git a/detections/application/windows_increase_in_user_modification_activity.yml b/detections/endpoint/windows_increase_in_user_modification_activity.yml similarity index 100% rename from detections/application/windows_increase_in_user_modification_activity.yml rename to detections/endpoint/windows_increase_in_user_modification_activity.yml diff --git a/detections/endpoint/windows_indicator_removal_via_rmdir.yml b/detections/endpoint/windows_indicator_removal_via_rmdir.yml index 34cb8e88a8..1655103c0c 100644 --- a/detections/endpoint/windows_indicator_removal_via_rmdir.yml +++ b/detections/endpoint/windows_indicator_removal_via_rmdir.yml @@ -1,6 +1,6 @@ name: Windows Indicator Removal Via Rmdir id: c4566d2c-b094-48a1-9c59-d66e22065560 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,11 +19,14 @@ description: The following analytic detects the execution of the 'rmdir' command of compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*rmdir*" - Processes.process = "* /s *" Processes.process = "* /q *" by Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.process_guid - Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_indicator_removal_via_rmdir_filter`' + Processes.process = "* /s *" Processes.process = "* /q *" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_indicator_removal_via_rmdir_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/rmdir.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/rmdir.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 4cddf9037b..aa054d7ff9 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -1,6 +1,6 @@ name: Windows Indirect Command Execution Via forfiles id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787 -version: 5 +version: 6 date: '2025-02-19' author: Eric McGinnis, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* - /c *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_forfiles_filter`' + /c *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_indirect_command_execution_via_forfiles_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 1417cefc15..44aa7aae12 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -1,6 +1,6 @@ name: Windows Indirect Command Execution Via pcalua id: 3428ac18-a410-4823-816c-ce697d26f7a8 -version: 5 +version: 6 date: '2025-02-19' author: Eric McGinnis, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* - -a*" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_pcalua_filter`' + -a*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_indirect_command_execution_via_pcalua_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml index 8a30dc7da3..00b8293730 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml @@ -1,6 +1,6 @@ name: Windows Indirect Command Execution Via Series Of Forfiles id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,13 +17,21 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_guid) as process_guid values(Processes.process_name) as - process_name count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "forfiles.exe" OR Processes.original_file_name = - "forfiles.exe" by Processes.parent_process_name Processes.parent_process Processes.dest - Processes.user _time span=1m | where count >=20 | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_series_of_forfiles_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.action) as action + values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) + as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid + values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) + as parent_process_path values(Processes.process) as process values(Processes.process_exec) + as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) + as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) + as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path) + as process_path values(Processes.user) as user values(Processes.user_id) as user_id + values(Processes.vendor_product) as vendor_product count min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name + = "forfiles.exe" OR Processes.original_file_name = "forfiles.exe" by Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user _time span=1m | where count + >=20 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `windows_indirect_command_execution_via_series_of_forfiles_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_information_discovery_fsutil.yml b/detections/endpoint/windows_information_discovery_fsutil.yml index f33a29088c..73d5f98364 100644 --- a/detections/endpoint/windows_information_discovery_fsutil.yml +++ b/detections/endpoint/windows_information_discovery_fsutil.yml @@ -1,6 +1,6 @@ name: Windows Information Discovery Fsutil id: 2181f261-93e6-4166-a5a9-47deac58feff -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="fsutil.exe" OR Processes.original_file_name = "fsutil.exe" AND Processes.process = "*fsinfo*" - by Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_information_discovery_fsutil_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_information_discovery_fsutil_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index 75fd3bf93a..88bd01a65f 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -1,6 +1,6 @@ name: Windows Ingress Tool Transfer Using Explorer id: 76753bab-f116-4ea3-8fb9-89b638be58a9 -version: 7 +version: 8 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*") - by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_ingress_tool_transfer_using_explorer_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_ingress_tool_transfer_using_explorer_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_inprocserver32_new_outlook_form.yml b/detections/endpoint/windows_inprocserver32_new_outlook_form.yml index 1522f40488..6611809784 100644 --- a/detections/endpoint/windows_inprocserver32_new_outlook_form.yml +++ b/detections/endpoint/windows_inprocserver32_new_outlook_form.yml @@ -1,6 +1,6 @@ name: Windows InProcServer32 New Outlook Form id: fedb49c4-4bd7-4d42-8fd9-f8c8538c73c4 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk data_source: @@ -17,9 +17,10 @@ description: The following analytic detects the creation or modification of regi and potential full system compromise. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" Registry.registry_value_data=*\\FORMS\\* - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.dest Registry.process_guid Registry.user | - `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_inprocserver32_new_outlook_form_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index 6778cf87fd..9fcd27a8d8 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -1,6 +1,6 @@ name: Windows Input Capture Using Credential UI Dll id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ data_source: search: '`sysmon` EventCode=7 (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", - "*:\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime - by Image ImageLoaded OriginalFileName dest EventCode Signed ProcessId ProcessGuid - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_input_capture_using_credential_ui_dll_filter`' + "*:\\program files*")) | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_input_capture_using_credential_ui_dll_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products. @@ -42,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 647e38256d..c2bf24f82c 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Credential Theft id: ccfeddec-43ec-11ec-b494-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Mauricio Velazo, Splunk status: production @@ -15,10 +15,11 @@ description: The following analytic detects instances where the Windows InstallU data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 process_name=installutil.exe loaded_file_path IN ("*\\samlib.dll", - "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime - by user_id, dest, process_name, loaded_file, loaded_file_path, original_file_name, - process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_installutil_credential_theft_filter`' + "*\\vaultcli.dll") | fillnull | stats count min(_time) as firstTime max(_time) as + lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -64,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 139e8140d7..3b4000d2dd 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil in Non Standard Path id: dcf74b22-7933-11ec-857c-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -20,10 +20,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*", "*\\Windows\\SystemApps\\*", "*\\WinSxS\\*", "*\\Windows\\Microsoft.NET\\*")) by - Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.original_file_name Processes.process_id - Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_in_non_standard_path_filter`' + Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_installutil_in_non_standard_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -91,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index 5ec074c256..fcedfa0264 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 11 -date: '2025-02-22' +version: 12 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: TTP @@ -16,25 +16,39 @@ description: The following analytic detects the Windows InstallUtil.exe binary m of this activity. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: |- - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_installutil` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name - Processes.original_file_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | join process_id dest - [| tstats `security_content_summariesonly` - count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != - 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.src - | `drop_dm_object_name(All_Traffic)` - | rename dest as command_and_control - | rename src as dest] - | table _time user src dest parent_process_name process_name process_path process process_id dest_port command_and_control - | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process values(command_and_control) as command_and_control by user dest process_name process_id dest_port parent_process_name - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `windows_installutil_remote_network_connection_filter` +search: "| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes\n\ + \ where `process_installutil`\n by Processes.action Processes.dest Processes.original_file_name\ + \ Processes.parent_process Processes.parent_process_exec \n Processes.parent_process_guid\ + \ Processes.parent_process_id Processes.parent_process_name \n Processes.parent_process_path\ + \ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash\ + \ \n Processes.process_id Processes.process_integrity_level Processes.process_name\ + \ Processes.process_path \n Processes.user Processes.user_id Processes.vendor_product\ + \ \n| `drop_dm_object_name(Processes)` \n| tstats prestats=t append=t `security_content_summariesonly`\ + \ count min(_time) as firstTime max(_time)\n as lastTime from datamodel=Network_Traffic.All_Traffic\ + \ where All_Traffic.dest_port!=0\n by All_Traffic.action All_Traffic.app All_Traffic.dest\ + \ All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction \n All_Traffic.dvc\ + \ All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip\ + \ All_Traffic.src_port \n All_Traffic.transport All_Traffic.user All_Traffic.vendor_product\ + \ All_Traffic.process_id\n| `drop_dm_object_name(All_Traffic)` \n| table action\ + \ dest original_file_name parent_process parent_process_exec \n parent_process_guid\ + \ parent_process_id parent_process_name \n parent_process_path process process_exec\ + \ process_guid process_hash \n process_id process_integrity_level process_name\ + \ process_path \n user user_id vendor_product app dest_ip dest_port direction dvc\ + \ protocol \n protocol_version src src_ip src_port transport \n| stats values(action)\ + \ as action values(dest) as dest values(original_file_name) as original_file_name\ + \ values(parent_process) as parent_process \n values(parent_process_exec) as parent_process_exec\ + \ values(parent_process_guid) as parent_process_guid \n values(parent_process_id)\ + \ as parent_process_id values(parent_process_name) as parent_process_name \n values(parent_process_path)\ + \ as parent_process_path values(process) as process \n values(process_exec) as\ + \ process_exec values(process_hash) as process_hash \n values(process_guid) as\ + \ process_guid values(process_integrity_level) as process_integrity_level values(process_name)\ + \ as process_name\n values(process_path) as process_path values(user) as user values(user_id)\ + \ as user_id \n values(vendor_product) as vendor_product values(app) as app values(dest_ip)\ + \ as dest_ip values(dest_port) as dest_port values(direction) as direction\n values(dvc)\ + \ as dvc values(protocol) as protocol values(protocol_version) as protocol_version\ + \ values(src) as src values(src_ip) as src_ip values(src_port) as src_port values(transport)\ + \ as transport by process_id \n| where isnotnull(process_name) AND isnotnull(dest_port)\ + \ \n| `windows_installutil_remote_network_connection_filter`" how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,8 +92,6 @@ rba: type: parent_process_name - field: process_name type: process_name - - field: command_and_control - type: ip_address tags: analytic_story: - Living Off The Land @@ -96,7 +108,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 014a79d1e8..7a7a39ad87 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Uninstall Option id: cfa7b9ac-43f0-11ec-9b48-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -21,8 +21,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") NOT (Processes.process IN ("*C:\\WINDOWS\\CCM\\*")) NOT (Processes.parent_process_name IN ("Microsoft.SharePoint.Migration.ClientInstaller.exe")) - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_installutil_uninstall_option_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -85,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 0b7b0f9896..694f33b26f 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Uninstall Option with Network id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,16 +15,37 @@ description: The following analytic identifies the use of Windows InstallUtil.ex movement within the network. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time - span=1h Processes.user Processes.process_id Processes.process_name Processes.dest - Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id - [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic - where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port - | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time user dest - parent_process_name process_name process_path process process_id dest_port C2 | - `windows_installutil_uninstall_option_with_network_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port!=0 by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_installutil_uninstall_option_with_network_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -86,7 +107,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index 3374400f25..bd7b2a8423 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil URL in Command Line id: 28e06670-43df-11ec-a569-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process - IN ("*http://*","*https://*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`' + IN ("*http://*","*https://*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_iso_lnk_file_creation.yml b/detections/endpoint/windows_iso_lnk_file_creation.yml index 06ff0f1426..ddbe3ca536 100644 --- a/detections/endpoint/windows_iso_lnk_file_creation.yml +++ b/detections/endpoint/windows_iso_lnk_file_creation.yml @@ -1,6 +1,6 @@ name: Windows ISO LNK File Creation id: d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk", "*.img.lnk", "*.vhd.lnk", "*vhdx.lnk") by - Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path - Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_iso_lnk_file_creation_filter`' + Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iso_lnk_file_creation_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, @@ -57,7 +59,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 19a3260fbf..d3f259a807 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,6 +1,6 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 8 +version: 9 date: '2024-12-16' author: Michael Haag, Splunk status: experimental @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java.exe - OR Processes.parent_process_name=w3wp.exe `windows_shells` by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_java_spawning_shells_filter`' + OR Processes.parent_process_name=w3wp.exe `windows_shells` by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_java_spawning_shells_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index f86999cc9b..09ecaa1bd0 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -1,6 +1,6 @@ name: Windows Kerberos Local Successful Logon id: 8309c3a8-4d34-48ae-ad66-631658214653 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -17,8 +17,10 @@ data_source: - Windows Event Log Security 4624 search: '`wineventlog_security` EventCode=4624 LogonType=3 AuthenticationPackageName=Kerberos action=success src=127.0.0.1 | stats count min(_time) as firstTime max(_time) as - lastTime by dest, subject, action, SubjectLogonId, user, TargetUserName, src | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_kerberos_local_successful_logon_filter`' + lastTime by action app authentication_method dest dvc process process_id process_name + process_path signature signature_id src src_port status subject user user_group + vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_kerberos_local_successful_logon_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml index 4ab43c381b..72bcb18278 100644 --- a/detections/endpoint/windows_known_abused_dll_created.yml +++ b/detections/endpoint/windows_known_abused_dll_created.yml @@ -1,6 +1,6 @@ name: Windows Known Abused DLL Created id: ea91651a-772a-4b02-ac3d-985b364a5f07 -version: 5 +version: 6 date: '2025-02-10' author: Steven Dick status: production @@ -14,21 +14,17 @@ description: The following analytic identifies the creation of Dynamic Link Libr could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security. data_source: -- Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name!="unknown" - Processes.process_name=* Processes.process_guid!=null by _time span=1h Processes.dest - Processes.user Processes.process_guid Processes.process_name Processes.process Processes.parent_process - Processes.parent_process_name | `drop_dm_object_name(Processes)` | join max=0 process_guid - dest [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") - Filesystem.file_name="*.dll" by _time span=1h Filesystem.dest Filesystem.file_create_time - Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` + Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup hijacklibs_loaded library AS file_name excludes as file_path OUTPUT - islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | stats latest(*) - as * by dest process_guid ] | where isnotnull(file_name) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' + islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -65,8 +61,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The file [$file_name$] was written to an unusual location by [$process_name$] - on [$dest$]. + message: The file [$file_name$] was written to an unusual location on [$dest$]. risk_objects: - field: dest type: system @@ -75,8 +70,6 @@ rba: type: user score: 10 threat_objects: - - field: process_name - type: process_name - field: file_name type: file_name tags: @@ -95,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml index fd906a1af0..991d0ea5ea 100644 --- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml +++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml @@ -1,6 +1,6 @@ name: Windows Known Abused DLL Loaded Suspiciously id: dd6d1f16-adc0-4e87-9c34-06189516b803 -version: 5 +version: 6 date: '2025-02-10' author: Steven Dick status: production @@ -13,17 +13,20 @@ description: The following analytic detects when DLLs with known abuse history a data_source: - Sysmon EventID 7 search: '`sysmon` ImageLoaded EventCode=7 NOT ImageLoaded IN ("*\\Program Files*","*\\system32\\*", - "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") | stats latest(ProcessGuid) as process_guid, - count, min(_time) as firstTime, max(_time) as lastTime by User, Computer, Image, - ImageLoaded | rename User as user, Computer as dest, Image as process, ImageLoaded - as loaded_file | eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), + "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded dest process_exec process_guid process_hash + process_id process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product loaded_file | rename Image as process + | eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), loaded_file_path = case(isnotnull(loaded_file), replace(loaded_file, "(:[\w\. ]+)", "")), loaded_file = case(isnotnull(loaded_file),replace(loaded_file,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), user = case(NOT user IN ("-"), replace(user, "(.*)\\\(.+)$","\2")) | lookup hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as desc | lookup hijacklibs_loaded library AS loaded_file excludes as loaded_file_path OUTPUT islibrary as excluded - | search islibrary = TRUE AND excluded = false | stats values(*) as * by dest, process_name, - process, process_guid, loaded_file, loaded_file_path | `security_content_ctime(firstTime)` + | search islibrary = TRUE AND excluded = false | stats count min(_time) as firstTime + max(_time) as lastTime by dest loaded_file loaded_file_path process process_exec + process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_loaded_suspiciously_filter`' how_to_implement: The following analytic requires Sysmon operational logs to be imported, with EID7 being mapped to the process_name field. Modify the sysmon macro as needed @@ -49,17 +52,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The module [$loaded_file$] was loaded from an unusual location by [$process$] + message: The module [$loaded_file$] was loaded from an unusual location. risk_objects: - field: dest type: system score: 10 - - field: user - type: user - score: 10 - threat_objects: - - field: process - type: process + threat_objects: [] tags: analytic_story: - Windows Defense Evasion Tactics @@ -76,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml index 8d8b1036e8..4f8a90ade3 100644 --- a/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml +++ b/detections/endpoint/windows_known_graphicalproton_loaded_modules.yml @@ -1,6 +1,6 @@ name: Windows Known GraphicalProton Loaded Modules id: bf471c94-0324-4b19-a113-d02749b969bc -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,11 @@ search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\AclNumsInvertHost.dll", "*\\Mo "*\\PerformanceCaptionApi.dll", "*\\WowIcmpRemoveReg.dll", "*\\BlendMonitorStringBuild.dll", "*\\HandleFrequencyAll.dll", "*\\HardSwapColor.dll", "*\\LengthInMemoryActivate.dll", "*\\ParametersNamesPopup.dll", "*\\ModeFolderSignMove.dll", "*\\ChildPaletteConnected.dll", - "*\\AddressResourcesSpec.dll") | stats count min(_time) as firstTime max(_time) - as lastTime by Image ImageLoaded process_name dest EventCode Signed ProcessId Hashes - IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_known_graphicalproton_loaded_modules_filter`' + "*\\AddressResourcesSpec.dll") | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_known_graphicalproton_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -64,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index 86f3c9da53..dd6da85598 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -1,6 +1,6 @@ name: Windows Large Number of Computer Service Tickets Requested id: 386ad394-c9a7-4b4f-b66f-586252de20f0 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk type: Anomaly @@ -16,8 +16,8 @@ description: The following analytic detects a high volume of Kerberos service ti to multiple endpoints, potentially compromising the entire network. search: '`wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" | bucket span=5m _time | stats dc(ServiceName) AS unique_targets values(ServiceName) - as host_targets by _time, IpAddress, TargetUserName | where unique_targets > 30 - | `windows_large_number_of_computer_service_tickets_requested_filter`' + as host_targets values(dest) as dest by _time, IpAddress, TargetUserName | where + unique_targets > 30 | `windows_large_number_of_computer_service_tickets_requested_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index 30ab7ce4b3..c1e92fc05d 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -1,6 +1,6 @@ name: Windows Ldifde Directory Object Behavior id: 35cd29ca-f08c-4489-8815-f715c45460d3 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ description: The following analytic identifies the use of Ldifde.exe, a command- or access sensitive information within the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ldifde.exe - Processes.process IN ("*-i *", "*-f *") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_ldifde_directory_object_behavior_filter`' + Processes.process IN ("*-i *", "*-f *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ldifde_directory_object_behavior_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/ldifde_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/ldifde_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index a18658909b..cc4769d2d7 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -1,6 +1,6 @@ name: Windows Linked Policies In ADSI Discovery id: 510ea428-4731-4d2f-8829-a28293e427aa -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the use of the `[Adsisearcher]` type data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText - = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | rename Computer as dest, user_id as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`' + = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -42,7 +42,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Windows PowerShell [Adsisearcher] was used user enumeration on $user$ + message: Windows PowerShell [Adsisearcher] was used user enumeration on $user_id$ risk_objects: - field: dest type: system @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml index 713dc4223e..4da44dd0e7 100644 --- a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -1,18 +1,44 @@ name: Windows List ENV Variables Via SET Command From Uncommon Parent id: aec157f4-8783-4584-aca6-754c4dc7fba9 -version: 1 +version: 2 date: '2025-01-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies a suspicious process command line fetching environment variables using the cmd.exe "set" command, with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity could be significant as it is commonly associated with malware like Qakbot, which uses this technique to gather system information. If confirmed malicious, this behavior could indicate that the parent process has been compromised, potentially allowing attackers to execute arbitrary commands, escalate privileges, or persist within the environment. +description: The following analytic identifies a suspicious process command line fetching + environment variables using the cmd.exe "set" command, with a non-shell parent process. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on + command-line executions and parent process names. This activity could be significant + as it is commonly associated with malware like Qakbot, which uses this technique + to gather system information. If confirmed malicious, this behavior could indicate + that the parent process has been compromised, potentially allowing attackers to + execute arbitrary commands, escalate privileges, or persist within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmd.exe" Processes.process IN ("*/c set", "*/c \"set") AND NOT Processes.parent_process_name IN ("cmd.exe", "explorer.exe", "powershell*" "pwsh.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_list_env_variables_via_set_command_from_uncommon_parent_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: shell process that are not included in this search may cause False positive. Filter as needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmd.exe" + Processes.process IN ("*/c set", "*/c \"set") AND NOT Processes.parent_process_name + IN ("cmd.exe", "explorer.exe", "powershell*" "pwsh.exe") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_list_env_variables_via_set_command_from_uncommon_parent_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: shell process that are not included in this search may cause + False positive. Filter as needed. references: - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg drilldown_searches: @@ -21,7 +47,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index 00ae64da90..2e10d857de 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -1,6 +1,6 @@ name: Windows Local Administrator Credential Stuffing id: 09555511-aca6-484a-b6ab-72cd03d73c34 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk type: TTP @@ -18,8 +18,9 @@ description: The following analytic detects attempts to authenticate using the b a severe security risk. search: '`wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as - host_targets by _time, IpAddress, TargetUserName, EventCode | where unique_targets - > 30 | `windows_local_administrator_credential_stuffing_filter`' + host_targets values(dest) as dest values(src) as src values(user) as user by _time, + IpAddress, TargetUserName, EventCode, action, app, authentication_method, signature, + signature_id | where unique_targets > 30 | `windows_local_administrator_credential_stuffing_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml index 571055f6e9..fcabe7e43b 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml @@ -1,6 +1,6 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 -version: 4 +version: 5 date: '2025-02-10' author: Steven Dick status: production @@ -20,11 +20,15 @@ search: '| tstats `security_content_summariesonly` latest(Processes.parent_proc as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") - BY Processes.user Processes.dest Processes.parent_process_name Processes.process_name - Processes.original_file_name Processes.process_path |`drop_dm_object_name(Processes)` - | where NOT match(process_name, "(?i)".original_file_name) | lookup lolbas_file_path - lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) + | lookup lolbas_file_path lolbas_file_name as original_file_name OUTPUT description + as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_lolbas_executed_as_renamed_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml index 3c51c0705d..82bcea77d7 100644 --- a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml +++ b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml @@ -1,6 +1,6 @@ name: Windows LOLBAS Executed Outside Expected Path id: 326fdf44-b90c-4d2e-adca-1fd140b10536 -version: 4 +version: 5 date: '2025-02-10' author: Steven Dick status: production @@ -17,8 +17,12 @@ search: '| tstats `security_content_summariesonly` latest(Processes.parent_proc as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where Processes.process != "unknown" AND NOT Processes.process_path IN ("*\\Program - Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") BY Processes.user - Processes.dest Processes.parent_process_name Processes.process_name Processes.process_path + Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | lookup lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc | lookup lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml b/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml index cdfe9a680d..cda7bd4fed 100644 --- a/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml +++ b/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml @@ -1,6 +1,6 @@ name: Windows LSA Secrets NoLMhash Registry id: 48cc1605-538c-4223-8382-e36bee5b540d -version: 6 +version: 7 date: '2025-01-21' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects modifications to the Windows registr to unauthorized access and credential theft. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\NoLMHash" - Registry.registry_value_data = 0x00000000) BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lsa_secrets_nolmhash_registry_filter`' + Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_lsa_secrets_nolmhash_registry_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml index 6661897452..637bc023a1 100644 --- a/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_mail_protocol_in_non_common_process_path.yml @@ -1,6 +1,6 @@ name: Windows Mail Protocol In Non-Common Process Path id: ac3311f5-661d-4e99-bd1f-3ec665b05441 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,10 @@ data_source: - Sysmon EventID 3 search: '`sysmon` EventCode=3 NOT(Image IN("*\\program files*", "*\\thunderbird.exe","*\\outlook.exe")) (DestinationPortName="smtp" OR DestinationPort=25 OR DestinationPort=587) | stats - count min(_time) as firstTime max(_time) as lastTime by Image DestinationPort DestinationPortName - DestinationHostname SourceHostname SourcePort SourcePortName Protocol DestinationIp - dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_mail_protocol_in_non_common_process_path_filter`' + count min(_time) as firstTime max(_time) as lastTime by action app dest dest_ip + dest_port direction dvc protocol protocol_version src src_ip src_port transport + user vendor_product process_name process_exec process_guid process_id | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_mail_protocol_in_non_common_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -44,8 +44,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a process $Image$ is having a SMTP connection to $DestinationHostname$ - on $dest$ + message: a process $process_name$ is having a SMTP connection to $dest$ in $dest_ip$ risk_objects: - field: dest type: system @@ -65,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_smtp/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_smtp/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml index c73d13fd93..7a9535be91 100644 --- a/detections/endpoint/windows_mark_of_the_web_bypass.yml +++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml @@ -1,6 +1,6 @@ name: Windows Mark Of The Web Bypass id: 8ca13343-7405-4916-a2d1-ae34ce0c28ae -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -14,10 +14,11 @@ description: The following analytic identifies a suspicious process that deletes restrictions on files downloaded from the internet. If confirmed malicious, this behavior could allow an attacker to execute potentially harmful files without triggering security warnings, leading to further compromise of the system. -search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" | stats min(_time) - as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename - ProcessID dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_mark_of_the_web_bypass_filter`' +search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" | stats count + min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash + file_name file_modify_time process_exec process_guid process_id process_name process_path + signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_mark_of_the_web_bypass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml index ff9d52c49c..768a42d7e8 100644 --- a/detections/endpoint/windows_masquerading_explorer_as_child_process.yml +++ b/detections/endpoint/windows_masquerading_explorer_as_child_process.yml @@ -1,6 +1,6 @@ name: Windows Masquerading Explorer As Child Process id: 61490da9-52a1-4855-a0c5-28233c88c481 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN("cmd.exe", "powershell.exe", "regsvr32.exe") AND Processes.process_name = "explorer.exe" - AND Processes.process IN ("*\\explorer.exe") by Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process_id Processes.process_guid Processes.process - Processes.user Processes.dest Processes.parent_process_id | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_masquerading_explorer_as_child_process_filter`' + AND Processes.process IN ("*\\explorer.exe") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `windows_masquerading_explorer_as_child_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_masquerading_msdtc_process.yml b/detections/endpoint/windows_masquerading_msdtc_process.yml index 82f5ed4dd0..c18801336a 100644 --- a/detections/endpoint/windows_masquerading_msdtc_process.yml +++ b/detections/endpoint/windows_masquerading_msdtc_process.yml @@ -1,6 +1,6 @@ name: Windows Masquerading Msdtc Process id: 238f3a07-8440-480b-b26f-462f41d9a47c -version: 5 +version: 6 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,12 @@ description: The following analytic identifies the execution of msdtc.exe with s severely compromising the affected system. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "msdtc.exe" - Processes.process = "*msdtc.exe*" Processes.process IN ("* -a*", "* -b*") by Processes.dest - Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + Processes.process = "*msdtc.exe*" Processes.process IN ("* -a*", "* -b*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_masquerading_msdtc_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/msdtc_process_param/msdtc_a_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/msdtc_process_param/msdtc_a_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index 8578d406d4..f8f7143d0a 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -1,6 +1,6 @@ name: Windows Mimikatz Binary Execution id: a9e0d6d3-9676-4e26-994d-4e0406bb4467 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=mimikatz.exe - OR Processes.original_file_name=mimikatz.exe) by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_mimikatz_binary_execution_filter`' + OR Processes.original_file_name=mimikatz.exe) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_mimikatz_binary_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -87,7 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 268990889c..dd12dd1613 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -1,6 +1,6 @@ name: Windows Mimikatz Crypto Export File Extensions id: 3a9a6806-16a8-4cda-8d73-b49d10a05b16 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -16,9 +16,11 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.keyx.rsa.pvk","*sign.rsa.pvk","*sign.dsa.pvk","*dsa.ec.p8k","*dh.ec.p8k", - "*.pfx", "*.der") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Filesystem)` | `windows_mimikatz_crypto_export_file_extensions_filter`' + "*.pfx", "*.der") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `windows_mimikatz_crypto_export_file_extensions_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/certwrite_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/certwrite_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml index 5528aed6bc..53248fd986 100644 --- a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml +++ b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry AuthenticationLevelOverride id: 6410a403-36bb-490f-a06a-11c3be7d2a41 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal Server Client\\AuthenticationLevelOverride" Registry.registry_value_data = 0x00000000 - by Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_authenticationleveloverride_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_authenticationleveloverride_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml index 31d99f0c81..188088e7de 100644 --- a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml +++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Auto Minor Updates id: be498b9f-d804-4bbf-9fc0-d5448466b313 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -8,8 +8,7 @@ type: Hunting data_source: - Sysmon EventID 13 description: The following analytic identifies a suspicious modification to the Windows - auto update configuration registry. It detects changes to the registry path - "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates" + auto update configuration registry. It detects changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates" with a value of "0x00000000". This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to bypass detection and deploy additional payloads. If confirmed malicious, this modification could allow @@ -17,8 +16,10 @@ description: The following analytic identifies a suspicious modification to the exploitation of zero-day vulnerabilities. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates" - AND Registry.registry_value_data="0x00000000" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_auto_minor_updates_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -43,7 +44,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index ba26e4b354..360b04a847 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Auto Update Notif id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ description: The following analytic detects a suspicious modification to the Win and exploit vulnerabilities on the target host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions" - AND Registry.registry_value_data="0x00000002" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000002" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_auto_update_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml index b149441e61..67d8ac0ee7 100644 --- a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml +++ b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Configure BitLocker id: bd1c770f-1b55-411e-b49e-20d07bcac5f8 -version: 3 +version: 4 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: @@ -19,10 +19,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_value_name IN("EnableBDEWithNoTPM", "EnableNonTPM", "UseAdvancedStartup") Registry.registry_value_data = 0x00000001) OR (Registry.registry_path= "*\\Policies\\Microsoft\\FVE\\*" Registry.registry_value_name IN("UsePIN", "UsePartialEncryptionKey", "UseTPM", "UseTPMKey", - "UseTPMKeyPIN", "UseTPMPIN") Registry.registry_value_data = 0x00000002) by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest Registry.registry_value_name | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_configure_bitlocker_filter`' + "UseTPMKeyPIN", "UseTPMPIN") Registry.registry_value_data = 0x00000002) by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_configure_bitlocker_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting//fve-reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting//fve-reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_default_icon_setting.yml b/detections/endpoint/windows_modify_registry_default_icon_setting.yml index 615b76086a..f4f4248ea3 100644 --- a/detections/endpoint/windows_modify_registry_default_icon_setting.yml +++ b/detections/endpoint/windows_modify_registry_default_icon_setting.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Default Icon Setting id: a7a7afdb-3c58-45b6-9bff-63e5acfd9d40 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - ="*\\defaultIcon\\(Default)*" Registry.registry_path = "*HKCR\\*" by Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.action Registry.dest Registry.user + ="*\\defaultIcon\\(Default)*" Registry.registry_path = "*HKCR\\*" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_modify_registry_default_icon_setting_filter`' how_to_implement: To successfully implement this search, you must be ingesting data @@ -70,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/lockbit_ransomware/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml index 971049a055..b9e061e519 100644 --- a/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml +++ b/detections/endpoint/windows_modify_registry_delete_firewall_rules.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Delete Firewall Rules id: 41c61539-98ca-4750-b3ec-7c29a2f06343 -version: 4 +version: 5 date: '2024-12-16' author: Teoderick Contreras, Splunk data_source: @@ -14,9 +14,9 @@ description: The following analytic detects a potential deletion of firewall rul security measures. Monitoring these activities helps maintain network integrity and prevent malicious attacks. search: '`sysmon` EventCode=12 TargetObject = "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" - EventType=DeleteValue | rename Computer as dest | rename User as user | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode EventType TargetObject - Image user dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + EventType=DeleteValue | stats count min(_time) as firstTime max(_time) as lastTime + by action dest process_guid process_id registry_hive registry_path registry_key_name + status user vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_delete_firewall_rules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index 92f43a1a5c..5940d1854c 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Disable RDP id: 11ed764f-eb9c-4be7-bdad-2209b9d33ee1 -version: 3 +version: 4 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: @@ -15,10 +15,12 @@ description: This analytic is developed to detect suspicious registry modificati signifying malicious activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal - Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_rdp_filter`' + Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000001" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_rdp_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -63,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp//fdenytsconnection-reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp//fdenytsconnection-reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml b/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml index f7f59a20a7..020af46cdb 100644 --- a/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml +++ b/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Disable Restricted Admin id: cee573a0-7587-48e6-ae99-10e8c657e89a -version: 6 +version: 7 date: '2025-01-21' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,12 @@ description: The following analytic detects modifications to the Windows registr risk of credential theft and unauthorized access to sensitive systems. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin" - Registry.registry_value_data = 0x00000000) BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_restricted_admin_filter`' + Registry.registry_value_data = 0x00000000) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_restricted_admin_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index b863852f48..00e41e5491 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -1,14 +1,13 @@ name: Windows Modify Registry Disable Toast Notifications id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects modifications to the Windows registry that disable toast notifications. It leverages data from the Endpoint.Registry datamodel, - specifically monitoring changes to the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" + specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" with a value set to "0x00000000". This activity is significant because disabling toast notifications can prevent users from receiving critical system and application updates, which adversaries like Azorult exploit for defense evasion. If confirmed @@ -18,10 +17,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" - Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_disable_toast_notifications_filter`' + Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index bbd6a66c0e..543f3e78ce 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Disable Win Defender Raw Write Notif id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index bfaa50d4a6..3fb19c4832 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Disable WinDefender Notifications id: 8e207707-ad40-4eb3-b865-3a52aec91f26 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects a suspicious registry modification a search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications\\DisableNotifications" AND Registry.registry_value_data="0x00000001" - by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data - Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_modify_registry_disable_windefender_notifications_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `windows_modify_registry_disable_windefender_notifications_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index 4f371481c0..32f5ec5694 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Disable Windows Security Center Notif id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" - Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_disable_windows_security_center_notif_filter`' + Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml index 588dca2749..5cf6b9bfd7 100644 --- a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml +++ b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry DisableRemoteDesktopAntiAlias id: 4927c6f1-4667-42e6-bd7a-f5222116386b -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects modifications to the Windows registr search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal Services\\DisableRemoteDesktopAntiAlias" Registry.registry_value_data = 0x00000001 - by Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disableremotedesktopantialias_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_disableremotedesktopantialias_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml index 2bc06373d3..4d912e1189 100644 --- a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml +++ b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry DisableSecuritySettings id: 989019b4-b7aa-418a-9a17-2293e91288b6 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects modifications to the Windows registr further exploitation and data exfiltration. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Terminal - Services\\DisableSecuritySettings" Registry.registry_value_data = 0x00000001 by Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disablesecuritysettings_filter`' + Services\\DisableSecuritySettings" Registry.registry_value_data = 0x00000001 by + Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_disablesecuritysettings_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disablesecuritysetting.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disablesecuritysetting.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index abfec7ddf6..b7a791d93c 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Disabling WER Settings id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows - Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_disabling_wer_settings_filter`' + Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_disabling_wer_settings_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index 053afc1756..629e56b03b 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -1,14 +1,13 @@ name: Windows Modify Registry DisAllow Windows App id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects modifications to the Windows registry aimed at preventing the execution of specific computer programs. It leverages data - from the Endpoint.Registry datamodel, focusing on changes to the registry path - "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" + from the Endpoint.Registry datamodel, focusing on changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" with a value of "0x00000001". This activity is significant as it can indicate an attempt to disable security tools, a tactic used by malware like Azorult. If confirmed malicious, this could allow an attacker to evade detection and maintain persistence @@ -17,10 +16,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" - Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_disallow_windows_app_filter`' + Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disallow_windows_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index 535a55111c..b4e88de2e8 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Do Not Connect To Win Update id: e09c598e-8dd0-4e73-b740-4b96b689199e -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -9,8 +9,7 @@ data_source: - Sysmon EventID 13 description: The following analytic detects a suspicious modification to the Windows registry that disables automatic updates. It leverages data from the Endpoint datamodel, - specifically monitoring changes to the registry path - "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" + specifically monitoring changes to the registry path "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" with a value of "0x00000001". This activity is significant as it can be used by adversaries, including malware like RedLine Stealer, to evade detection and prevent the system from receiving critical updates. If confirmed malicious, this could allow @@ -18,8 +17,10 @@ description: The following analytic detects a suspicious modification to the Win deploy additional payloads. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" - AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_do_not_connect_to_win_update_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml index 76229f0ecd..a8806114e5 100644 --- a/detections/endpoint/windows_modify_registry_dontshowui.yml +++ b/detections/endpoint/windows_modify_registry_dontshowui.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry DontShowUI id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects modifications to the Windows Error R without user intervention. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Windows\\Windows - Error Reporting\\DontShowUI" Registry.registry_value_data = 0x00000001 by Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_dontshowui_filter`' + Error Reporting\\DontShowUI" Registry.registry_value_data = 0x00000001 by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_dontshowui_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml index fe881b80d6..6373422b38 100644 --- a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml +++ b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry EnableLinkedConnections id: 93048164-3358-4af0-8680-aa5f38440516 -version: 6 +version: 7 date: '2025-01-21' author: Teoderick Contreras, Splunk status: production @@ -9,8 +9,7 @@ data_source: - Sysmon EventID 13 description: The following analytic detects a suspicious modification to the Windows registry setting for EnableLinkedConnections. It leverages data from the Endpoint.Registry - datamodel to identify changes where the registry path is - "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" + datamodel to identify changes where the registry path is "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" and the value is set to "0x00000001". This activity is significant because enabling linked connections can allow network shares to be accessed with both standard and administrator-level privileges, a technique often abused by malware like BlackByte @@ -18,10 +17,11 @@ description: The following analytic detects a suspicious modification to the Win network resources, escalating the attacker's privileges. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections" - Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_enablelinkedconnections_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_enablelinkedconnections_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -68,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml index 95710bc80b..b57a6b5613 100644 --- a/detections/endpoint/windows_modify_registry_longpathsenabled.yml +++ b/detections/endpoint/windows_modify_registry_longpathsenabled.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry LongPathsEnabled id: 36f9626c-4272-4808-aadd-267acce681c0 -version: 6 +version: 7 date: '2025-01-21' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,11 @@ description: The following analytic detects a modification to the Windows regist persistence and further system compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled" - Registry.registry_value_data = "0x00000001") BY Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_longpathsenabled_filter`' + Registry.registry_value_data = "0x00000001") by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_longpathsenabled_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml index 5edfb914d8..4dd214fe49 100644 --- a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml +++ b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry MaxConnectionPerServer id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,12 @@ description: The following analytic identifies a suspicious modification of the search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet - Settings\\MaxConnectionsPer1_0Server*") Registry.registry_value_data = "0x0000000a" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_maxconnectionperserver_filter`' + Settings\\MaxConnectionsPer1_0Server*") Registry.registry_value_data = "0x0000000a" + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_maxconnectionperserver_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/maxconnectionperserver/registry_event.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/maxconnectionperserver/registry_event.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index 07ea3f47c2..43b0e7d7c7 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry No Auto Reboot With Logon User id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -9,16 +9,17 @@ data_source: - Sysmon EventID 13 description: The following analytic detects a suspicious modification to the Windows registry that disables automatic reboot with a logged-on user. This detection leverages - the Endpoint data model to identify changes to the registry path - `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers` + the Endpoint data model to identify changes to the registry path `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers` with a value of `0x00000001`. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to evade detection and maintain persistence. If confirmed malicious, this could allow attackers to bypass security measures and deploy additional payloads without interruption. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers" - AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_reboot_with_logon_user_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index bfa5786c82..ce9f98c912 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry No Auto Update id: fbd4f333-17bb-4eab-89cb-860fa2e0600e -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,10 @@ description: The following analytic identifies a suspicious modification to the the system vulnerable to further exploitation and potential zero-day attacks. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate" - AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_no_auto_update_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml b/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml index 8cf8c28925..1d3f847d87 100644 --- a/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml +++ b/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry NoChangingWallPaper id: a2276412-e254-4e9a-9082-4d92edb6a3e0 -version: 6 +version: 7 date: '2025-01-21' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,12 @@ description: The following analytic detects modifications to the Windows registr leading to further system compromise and user disruption. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\\NoChangingWallPaper" - Registry.registry_value_data = 1) BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_nochangingwallpaper_filter`' + Registry.registry_value_data = 1) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_nochangingwallpaper_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml index ed648702e8..aaf9eefca3 100644 --- a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml +++ b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry on Smart Card Group Policy id: 1522145a-8e86-4f83-89a8-baf62a8f489d -version: 3 +version: 4 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: @@ -14,10 +14,11 @@ description: This analytic is developed to detect suspicious registry modificati method, possibly signifying malicious intent to manipulate system security protocols. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\Policies\\System\\scforceoption*" - Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user - Registry.registry_path Registry.registry_value_data Registry.action Registry.dest - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_on_smart_card_group_policy_filter`' + Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_on_smart_card_group_policy_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml index 1424edc644..739a5baeb0 100644 --- a/detections/endpoint/windows_modify_registry_proxyenable.yml +++ b/detections/endpoint/windows_modify_registry_proxyenable.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry ProxyEnable id: b27f20bd-ef20-41d1-a1e9-25dedd5bf2f5 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects modifications to the Windows registr and data exfiltration, thereby compromising the security of the affected host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Internet - Settings\\ProxyEnable" Registry.registry_value_data = 0x00000001 by Registry.registry_path - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_proxyenable_filter`' + Settings\\ProxyEnable" Registry.registry_value_data = 0x00000001 by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_proxyenable_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_enable/proxyenable.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_enable/proxyenable.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml index e911d422ac..5f24198e26 100644 --- a/detections/endpoint/windows_modify_registry_proxyserver.yml +++ b/detections/endpoint/windows_modify_registry_proxyserver.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry ProxyServer id: 12bdaa0b-3c59-4489-aae1-bff6d67746ef -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,11 @@ description: The following analytic detects modifications to the Windows registr channels for data exfiltration or further exploitation of the compromised host. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Internet - Settings\\ProxyServer" by Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` - | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_proxyserver_filter`' + Settings\\ProxyServer" by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_proxyserver_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml index 23415d8628..9125b67df9 100644 --- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml +++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Qakbot Binary Data Registry id: 2e768497-04e0-4188-b800-70dd2be0e30d -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Bhavin Patel, Splunk status: production @@ -18,21 +18,26 @@ data_source: - Sysmon EventID 1 AND Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count dc(registry_value_name) as registry_value_name_count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\*" - AND Registry.registry_value_data = "Binary Data" by _time span=1m Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid Registry.process_id Registry.registry_key_name | `drop_dm_object_name(Registry)` - | eval registry_key_name_len = len(registry_key_name) | eval registry_value_name_len - = len(registry_value_name) | regex registry_value_name="^[0-9a-fA-F]{8}" | where - registry_key_name_len < 80 AND registry_value_name_len == 8 | join process_guid, + AND Registry.registry_value_data = "Binary Data" by _time span=1m Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | eval registry_key_name_len = len(registry_key_name) + | eval registry_value_name_len = len(registry_value_name) | regex registry_value_name="^[0-9a-fA-F]{8}" + | where registry_key_name_len < 80 AND registry_value_name_len == 8 | join process_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("explorer.exe", "wermgr.exe","dxdiag.exe", "OneDriveSetup.exe", - "mobsync.exe", "msra.exe", "xwizard.exe") by _time span=1m Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid Processes.process_path | `drop_dm_object_name(Processes)` - ] | stats min(_time) as firstTime max(_time) as lastTime values(registry_value_name) - as registry_value_name dc(registry_value_name) as registry_value_name_count values(registry_key_name) - by dest process_guid process_name parent_process_name | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | where registry_value_name_count >= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`' + "mobsync.exe", "msra.exe", "xwizard.exe") by _time span=1m Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` ] | stats min(_time) as firstTime max(_time) + as lastTime values(registry_value_name) as registry_value_name dc(registry_value_name) + as registry_value_name_count values(registry_key_name) by dest process_guid process_name + parent_process_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | where registry_value_name_count >= 5 | `windows_modify_registry_qakbot_binary_data_registry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml index b434791ec5..3fc45fe76a 100644 --- a/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml +++ b/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Regedit Silent Reg Import id: 824dd598-71be-4203-bc3b-024f4cda340e -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") - AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`' + AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_regedit_silent_reg_import_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 503041ecee..a75f59daff 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_suppress_win_defender_notif_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index d46912c0be..9634e06bbd 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Tamper Protection id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ description: The following analytic detects a suspicious modification to the Win search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection" AND Registry.registry_value_data="0x00000000" - by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data - Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_modify_registry_tamper_protection_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `windows_modify_registry_tamper_protection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml index 23d5b302d1..076a776081 100644 --- a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml +++ b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry to Add or Modify Firewall Rule id: 43254751-e2ce-409a-b6b4-4f851e8dcc26 -version: 5 +version: 6 date: '2024-12-08' author: Teoderick Contreras, Splunk data_source: @@ -16,9 +16,10 @@ description: The following analytic detects a potential addition or modification unauthorized network access. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.action - = modified BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid Registry.dest Registry.user - Registry.action | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + = modified by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_to_add_or_modify_firewall_rule_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml index d74aba8e37..dabe7abc87 100644 --- a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml +++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry UpdateServiceUrlAlternate id: ca4e94fb-7969-4d63-8630-3625809a1f70 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ description: The following analytic detects a suspicious modification to the Win further system compromise, and persistent evasion of security defenses. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\UpdateServiceUrlAlternate" - by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data - Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_modify_registry_updateserviceurlalternate_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `windows_modify_registry_updateserviceurlalternate_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml index a36826a260..ff68181b94 100644 --- a/detections/endpoint/windows_modify_registry_usewuserver.yml +++ b/detections/endpoint/windows_modify_registry_usewuserver.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry USeWuServer id: c427bafb-0b2c-4b18-ad85-c03c6fed9e75 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ description: The following analytic detects a suspicious modification to the Win payloads. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\UseWUServer" - AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000001" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_modify_registry_usewuserver_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -43,7 +45,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_utilize_progids.yml b/detections/endpoint/windows_modify_registry_utilize_progids.yml index f7f623b1bc..e555a5a77f 100644 --- a/detections/endpoint/windows_modify_registry_utilize_progids.yml +++ b/detections/endpoint/windows_modify_registry_utilize_progids.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry Utilize ProgIDs id: 64fa82dd-fd11-472a-9e94-c221fffa591d -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: @@ -17,10 +17,12 @@ description: The following analytic detects modifications to the Windows Registr detection of these modifications helps mitigate unauthorized execution and prevents further exploitation of the system. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE Registry.registry_path= "*\\ms-settings\\CurVer\\(Default)" BY Registry.dest - Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_utilize_progids_filter`' + WHERE Registry.registry_path= "*\\ms-settings\\CurVer\\(Default)" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_utilize_progids_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml index 578bbc1b8d..5175b182e2 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml @@ -1,28 +1,29 @@ name: Windows Modify Registry ValleyRAT C2 Config id: ac59298a-8d81-4c02-8c9b-ffdac993891f -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 13 type: TTP status: production -description: The following analytic detects modifications to theregistry related to - ValleyRAT C2 configuration. Specifically, it monitors changes in registry keys - where ValleyRAT saves the IP address and port information of its command-and-control - (C2) server. This activity is a key indicator of ValleyRAT attempting to establish - persistent communication with its C2 infrastructure. By identifying these unauthorized - registry modifications, security analysts can quickly detect malicious configurations - and investigate the associated threats. Early detection of these changes helps prevent - further exploitation and limits the malware’s ability to exfiltrate data or control - infected systems. +description: "The following analytic detects modifications to theregistry related\ + \ to ValleyRAT C2 configuration. Specifically, it monitors changes in registry\ + \ keys where ValleyRAT saves the IP address and port information of its command-and-control\ + \ (C2) server. This activity is a key indicator of ValleyRAT attempting to establish\ + \ persistent communication with its C2 infrastructure. By identifying these unauthorized\ + \ registry modifications, security analysts can quickly detect malicious configurations\ + \ and investigate the associated threats. Early detection of these changes helps\ + \ prevent further exploitation and limits the malware\u2019s ability to exfiltrate\ + \ data or control infected systems." search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Console\\IpDateInfo" AND Registry.registry_value_data="Binary Data") OR (Registry.registry_path= "*\\Console\\SelfPath" AND Registry.registry_value_data="*.exe") - BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.registry_hive - Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_c2_config_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_modify_registry_valleyrat_c2_config_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml index 1f0d757c88..913c572d24 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry ValleyRat PWN Reg Entry id: 6947c44e-be1f-4dd9-b198-bc42be5be196 -version: 6 +version: 7 date: '2024-12-16' author: Teoderick Contreras, Splunk data_source: @@ -17,10 +17,11 @@ description: The following analytic detects modifications to the Windows Registr and prevents further exploitation of the system. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*.pwn\\Shell\\Open\\command" OR Registry.registry_value_data - = ".pwn") BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_registry_valleyrat_pwn_reg_entry_filter`' + = ".pwn") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_modify_registry_valleyrat_pwn_reg_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/pwn_reg/pwn_reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml index 35340359e9..02b792d50b 100644 --- a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml +++ b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry With MD5 Reg Key Name id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,15 +17,17 @@ description: The following analytic detects potentially malicious registry modif and exfiltrate sensitive information. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path - = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" by Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.registry_key_name | `drop_dm_object_name(Registry)` | eval dropped_reg_path - = split(registry_path, "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) - | eval validation_result= if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") - | where validation_result = "md5" AND dropped_reg_path_split_count <= 5 | table - dest user registry_path registry_value_name registry_value_data registry_key_name - reg_key_name dropped_reg_path_split_count validation_result | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_modify_registry_with_md5_reg_key_name_filter`' + = "*\\SOFTWARE\\*" Registry.registry_value_data = "Binary Data" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | eval dropped_reg_path = split(registry_path, + "\\") | eval dropped_reg_path_split_count = mvcount(dropped_reg_path) | eval validation_result= + if(match(registry_value_name,"^[0-9a-fA-F]{32}$"),"md5","nonmd5") | where validation_result + = "md5" AND dropped_reg_path_split_count <= 5 | table dest user registry_path registry_value_name + registry_value_data registry_key_name reg_key_name dropped_reg_path_split_count + validation_result | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `windows_modify_registry_with_md5_reg_key_name_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml index 9eafa1c67a..c28ee4daa0 100644 --- a/detections/endpoint/windows_modify_registry_wuserver.yml +++ b/detections/endpoint/windows_modify_registry_wuserver.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry WuServer id: a02ad386-e26d-44ce-aa97-6a46cee31439 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ description: The following analytic detects suspicious modifications to the Wind unauthorized access. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUServer" - by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data - Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_modify_registry_wuserver_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `windows_modify_registry_wuserver_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -43,7 +45,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml index 7e4c018ac2..4896a0a1b3 100644 --- a/detections/endpoint/windows_modify_registry_wustatusserver.yml +++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry wuStatusServer id: 073e69d0-68b2-4142-aa90-a7ee6f590676 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ description: The following analytic identifies suspicious modifications to the W and persistent unauthorized access. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUStatusServer" - by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data - Registry.registry_key_name | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_modify_registry_wustatusserver_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `windows_modify_registry_wustatusserver_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -43,7 +45,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 6e46ecf40e..35edca0366 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -1,6 +1,6 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 8 +version: 9 date: '2024-12-08' author: Teoderick Contreras, Splunk, Steven Dick status: production @@ -17,11 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" - AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) BY Registry.dest - Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` - | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_modify_show_compress_color_and_info_tip_registry_filter`' + AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml b/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml index 97cd11c575..ee5d6b7c4a 100644 --- a/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml +++ b/detections/endpoint/windows_modify_system_firewall_with_notable_process_path.yml @@ -1,6 +1,6 @@ name: Windows Modify System Firewall with Notable Process Path id: cd6d7410-9146-4471-a418-49edba6dadc4 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Will Metcalf, Splunk status: production @@ -23,10 +23,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*","*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", - "*\\temp\\*", "*\\PerfLogs\\*") by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_modify_system_firewall_with_notable_process_path_filter`' + "*\\temp\\*", "*\\PerfLogs\\*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_system_firewall_with_notable_process_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/njrat_firewall_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/njrat_firewall_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 5906eedfab..d30cd02719 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -1,6 +1,6 @@ name: Windows MOF Event Triggered Execution via WMI id: e59b5a73-32bf-4467-a585-452c36ae10c1 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe - Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*")) by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`' + Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*")) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_mof_event_triggered_execution_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +89,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml index 47eebe3109..6477fcb500 100644 --- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml +++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml @@ -1,12 +1,12 @@ name: Windows MOVEit Transfer Writing ASPX id: c0ed2aca-5666-45b3-813f-ddfac3f3eda0 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: experimental type: TTP data_source: -- Sysmon EventID 11 +- Sysmon EventID 1 AND Sysmon EventID 11 description: The following analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. It leverages endpoint data on process and filesystem activity to identify processes responsible for creating these @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/moveit_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/moveit_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml index 8cc18bc69f..2f260890a9 100644 --- a/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml +++ b/detections/endpoint/windows_msexchange_management_mailbox_cmdlet_usage.yml @@ -1,6 +1,6 @@ name: Windows MSExchange Management Mailbox Cmdlet Usage id: 396de86f-25e7-4b0e-be09-a330be35249d -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -12,10 +12,7 @@ description: The following analytic identifies suspicious Cmdlet usage in Exchan access or manipulation of mailboxes and roles, which are critical for maintaining email security. If confirmed malicious, attackers could export mailbox data, assign new roles, or search mailboxes, leading to data breaches and privilege escalation. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +data_source: [] search: '`msexchange_management` EventCode=1 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*", "*Search-Mailbox*") | stats count min(_time) as firstTime max(_time) as lastTime by host Message | `security_content_ctime(firstTime)` @@ -67,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/msexchangemanagement.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/msexchangemanagement.log source: WinEventLog:MSExchange Management sourcetype: MSExchange:management diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index 719243bc89..f0ec6e2213 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -1,6 +1,6 @@ name: Windows Mshta Execution In Registry id: e13ceade-b673-4d34-adc4-4d9c01729753 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_data = "*mshta*" OR Registry.registry_value_data IN ("*javascript:*", "*vbscript:*","*WScript.Shell*") - by Registry.registry_key_name Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest Registry.user| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_mshta_execution_in_registry_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_mshta_execution_in_registry_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -70,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml index 29db36c412..66b5c4a9da 100644 --- a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml +++ b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml @@ -1,6 +1,6 @@ name: Windows MSHTA Writing to World Writable Path id: efbcf8ee-bc75-47f1-8985-a5c638c4faf0 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk data_source: @@ -24,9 +24,9 @@ search: '`sysmon` EventCode=11 Image="*\\mshta.exe" TargetFilename IN ("*\\Windo and Desktop Connections Update\\*", "*\\Windows\\SysWOW64\\Tasks\\*", "*\\Windows\\SysWOW64\\Com\\dmp\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\RemoteApp and Desktop Connections Update\\*", "*\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\System\\*") - | rename Computer as dest, User as user | stats count min(_time) as firstTime max(_time) - as lastTime by dest, user, Image, TargetFilename | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_mshta_writing_to_world_writable_path_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name + file_path process_guid process_id user user_id vendor_product Image TargetFilename + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mshta_writing_to_world_writable_path_filter`' how_to_implement: The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into Splunk. The search focuses on EventCode 11 where the Image is `mshta.exe` and the @@ -85,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 862e6c9f89..4cafa5c6fe 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process - IN ("*/y*", "*-y*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`' + IN ("*/y*", "*-y*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_dllregisterserver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml index c5d9918949..2225347c56 100644 --- a/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml +++ b/detections/endpoint/windows_msiexec_hidewindow_rundll32_execution.yml @@ -1,6 +1,6 @@ name: Windows MsiExec HideWindow Rundll32 Execution id: 9683271d-92e4-43b5-a907-1983bfb9f7fd -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,8 +20,11 @@ description: The following analytic detects the execution of the msiexec.exe pro search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = msiexec.exe Processes.process = "* /HideWindow *" Processes.process = "* rundll32*" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_hidewindow_rundll32_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index ea822dfe4d..1fe02fc074 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process - IN ("*http://*", "*https://*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`' + IN ("*http://*", "*https://*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_remote_download_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index a604c6a7d5..a2e25e0fd9 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Spawn Discovery Command id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -20,8 +20,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe Processes.process_name IN ("powershell.exe", "pwsh.exe","cmd.exe", "nltest.exe","ipconfig.exe","systeminfo.exe") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_spawn_discovery_command_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_spawn_windbg.yml b/detections/endpoint/windows_msiexec_spawn_windbg.yml index c80059d8d6..d296935767 100644 --- a/detections/endpoint/windows_msiexec_spawn_windbg.yml +++ b/detections/endpoint/windows_msiexec_spawn_windbg.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Spawn WinDBG id: 9a18f7c2-1fe3-47b8-9467-8b3976770a30 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,12 @@ description: The following analytic identifies the unusual behavior of MSIExec s within the environment. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msiexec.exe - Processes.process_name=windbg.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process_path Processes.parent_process Processes.process_name Processes.process_path - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + Processes.process_name=windbg.exe by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_msiexec_spawn_windbg_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -81,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windbg_msiexec.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windbg_msiexec.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 697c254586..650f01c384 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Unregister DLLRegisterServer id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msiexec` Processes.process - IN ("*/z*", "*-z*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`' + IN ("*/z*", "*-z*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_msiexec_unregister_dllregisterserver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_multiple_account_passwords_changed.yml b/detections/endpoint/windows_multiple_account_passwords_changed.yml index 509ea8e8c0..481f0b6b9f 100644 --- a/detections/endpoint/windows_multiple_account_passwords_changed.yml +++ b/detections/endpoint/windows_multiple_account_passwords_changed.yml @@ -1,6 +1,6 @@ name: Windows Multiple Account Passwords Changed id: faefb681-14be-4f0d-9cac-0bc0160c7280 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk data_source: @@ -16,9 +16,9 @@ description: The following analytic detects instances where more than five uniqu could lead to widespread account compromise, unauthorized access to sensitive information, and potential disruption of services. search: '`wineventlog_security` EventCode=4724 status=success | bucket span=10m _time - | stats count dc(user) as unique_users values(user) as user by EventCode signature - _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users - > 5 | `windows_multiple_account_passwords_changed_filter`' + | stats count dc(user) as unique_users values(user) as user values(dest) as dest + by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID + | where unique_users > 5 | `windows_multiple_account_passwords_changed_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/windows_multiple_passwords_changed.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/windows_multiple_passwords_changed.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_multiple_accounts_deleted.yml b/detections/endpoint/windows_multiple_accounts_deleted.yml index 255acdfca6..9a05ad8bcf 100644 --- a/detections/endpoint/windows_multiple_accounts_deleted.yml +++ b/detections/endpoint/windows_multiple_accounts_deleted.yml @@ -1,6 +1,6 @@ name: Windows Multiple Accounts Deleted id: 49c0d4d6-c55d-4d3a-b3d5-7709fafed70d -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk data_source: @@ -15,9 +15,9 @@ description: The following analytic detects the deletion of more than five uniqu actions. If confirmed malicious, this could lead to unauthorized access removal, hindering incident response and forensic investigations. search: '`wineventlog_security` EventCode=4726 status=success | bucket span=10m _time - | stats count dc(user) as unique_users values(user) as user by EventCode signature - _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users - > 5 | `windows_multiple_accounts_deleted_filter`' + | stats count dc(user) as unique_users values(user) as user values(dest) as dest + by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID + | where unique_users > 5 | `windows_multiple_accounts_deleted_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/windows_multiple_accounts_deleted.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/windows_multiple_accounts_deleted.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_multiple_accounts_disabled.yml b/detections/endpoint/windows_multiple_accounts_disabled.yml index 5976653e84..ed272245c8 100644 --- a/detections/endpoint/windows_multiple_accounts_disabled.yml +++ b/detections/endpoint/windows_multiple_accounts_disabled.yml @@ -1,6 +1,6 @@ name: Windows Multiple Accounts Disabled id: 5d93894e-befa-4429-abde-7fc541020b7b -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk data_source: @@ -16,9 +16,9 @@ description: The following analytic identifies instances where more than five un this activity could lead to widespread account lockouts, hindering user access and potentially disrupting business operations. search: '`wineventlog_security` EventCode=4725 status=success | bucket span=10m _time - | stats count dc(user) as unique_users values(user) as user by EventCode signature - _time src_user SubjectDomainName TargetDomainName Logon_ID | where unique_users - > 5 | `windows_multiple_accounts_disabled_filter`' + | stats count dc(user) as unique_users values(user) as user values(dest) as dest + by EventCode signature _time src_user SubjectDomainName TargetDomainName Logon_ID + | where unique_users > 5 | `windows_multiple_accounts_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events with the Windows TA. The Advanced Security Audit policy setting `Audit User Account Management` within `Account Management` needs to be @@ -63,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/windows_multiple_accounts_disabled.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/windows_multiple_accounts_disabled.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml index cc48eeadc3..f4082732ee 100644 --- a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml +++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml @@ -1,6 +1,6 @@ name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos id: 98f22d82-9d62-11eb-9fcf-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk type: TTP @@ -40,7 +40,8 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, IpAddress | where unique_accounts > 30 | `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`' + as user values(dest) as dest by _time, IpAddress | where unique_accounts > 30 | + `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`' rba: message: Potential Kerberos based password spraying attack from $IpAddress$ risk_objects: @@ -65,8 +66,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml index 993132ddda..e984b75b4a 100644 --- a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml @@ -1,7 +1,7 @@ name: Windows Multiple Invalid Users Fail To Authenticate Using Kerberos id: 001266a6-9d5b-11eb-829b-acde48001122 date: '2025-02-10' -version: 6 +version: 7 type: TTP status: production author: Mauricio Velazco, Splunk @@ -40,7 +40,8 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, IpAddress | where unique_accounts > 30 | `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter`' + as user values(dest) as dest by _time, IpAddress | where unique_accounts > 30 | + `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter`' rba: message: Potential Kerberos based password spraying attack from $IpAddress$ risk_objects: @@ -65,8 +66,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml index 88dc4a2ca2..70a29bab40 100644 --- a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml @@ -1,7 +1,7 @@ name: Windows Multiple Invalid Users Failed To Authenticate Using NTLM id: 57ad5a64-9df7-11eb-a290-acde48001122 type: TTP -version: 7 +version: 8 author: Mauricio Velazco, Splunk status: production data_source: @@ -43,7 +43,8 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as tried_accounts by _time, Workstation | where unique_accounts > 30 | `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`' + as tried_accounts values(dest) as dest by _time, Workstation | where unique_accounts + > 30 | `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`' rba: message: Potential NTLM based password spraying attack from $Workstation$ risk_objects: @@ -65,8 +66,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml index 7d72b1462b..5cf8a777dd 100644 --- a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml @@ -1,7 +1,7 @@ name: Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials id: e61918fa-9ca4-11eb-836c-acde48001122 type: TTP -version: 7 +version: 8 status: production author: Mauricio Velazco, Splunk data_source: @@ -44,8 +44,8 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ | bucket span=5m _time | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) - as tried_account by _time, Computer, Caller_User_Name | where unique_accounts > - 30 | `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter`' + as tried_account values(dest) as dest values(src_ip) as src_ip values(user) as user + by _time, Computer, Caller_User_Name | where unique_accounts > 30 | `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter`' rba: message: Potential password spraying attack from $Computer$ risk_objects: @@ -68,8 +68,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index d3c8a07eb4..4fa3eb78ad 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -3,7 +3,7 @@ id: 7ed272a4-9c77-11eb-af22-acde48001122 author: Mauricio Velazco, Splunk type: TTP status: production -version: 7 +version: 8 data_source: - Windows Event Log Security 4776 date: '2025-02-10' @@ -42,7 +42,8 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as tried_accounts by _time, Workstation | where unique_accounts > 30 | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`' + as tried_accounts values(dest) as dest by _time, Workstation | where unique_accounts + > 30 | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`' rba: message: Potential NTLM based password spraying attack from $Workstation$ risk_objects: @@ -64,8 +65,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml index 8d8df90f05..538ccb75cf 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml @@ -1,7 +1,7 @@ name: Windows Multiple Users Failed To Authenticate From Process id: 9015385a-9c84-11eb-bef2-acde48001122 type: TTP -version: 7 +version: 8 status: production author: Mauricio Velazco, Splunk data_source: @@ -42,8 +42,10 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as tried_accounts by _time, ProcessName, SubjectUserName, Computer | rename Computer - as dest | where unique_accounts > 30 | `windows_multiple_users_failed_to_authenticate_from_process_filter`' + as tried_accounts values(dest) as dest values(src) as src values(user) as user by + _time, ProcessName, SubjectUserName, Computer, action, app, authentication_method, + signature, signature_id | rename Computer as dest | where unique_accounts > 30 | + `windows_multiple_users_failed_to_authenticate_from_process_filter`' rba: message: Potential password spraying attack from $dest$ risk_objects: @@ -66,8 +68,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml index 2a4325b756..fa7bb5d110 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml @@ -1,7 +1,7 @@ name: Windows Multiple Users Failed To Authenticate Using Kerberos id: 3a91a212-98a9-11eb-b86a-acde48001122 type: TTP -version: 6 +version: 7 date: '2025-02-10' status: production author: Mauricio Velazco, Splunk @@ -42,7 +42,8 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, IpAddress | where unique_accounts > 30 | `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`' + as user values(dest) as dest by _time, IpAddress | where unique_accounts > 30 | + `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`' rba: message: Potential Kerberos based password spraying attack from $IpAddress$ risk_objects: @@ -67,8 +68,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml index 8e5c99c808..5b3add2ed9 100644 --- a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml +++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml @@ -3,7 +3,7 @@ id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 author: Mauricio Velazco, Splunk type: TTP status: production -version: 7 +version: 8 date: '2025-02-10' data_source: - Windows Event Log Security 4625 @@ -44,8 +44,9 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as tried_accounts by _time, IpAddress, Computer | rename Computer as dest| where - unique_accounts > 30 | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter`' + as tried_accounts values(dest) as dest values(src) as src values(user) as user by + _time, IpAddress, Computer, action, app, authentication_method, signature, signature_id + | rename Computer as dest | where unique_accounts > 30 | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter`' rba: message: Potential password spraying attack on $dest$ risk_objects: @@ -67,8 +68,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml index e746c54512..e49609ead4 100644 --- a/detections/endpoint/windows_network_connection_discovery_via_net.yml +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -1,17 +1,41 @@ name: Windows Network Connection Discovery Via Net id: 86a5b949-679b-4197-8d4c-9c180a818c45 -version: 1 +version: 2 date: '2025-01-13' author: Mauricio Velazco, Splunk status: production type: Hunting -description: The following analytic identifies the execution of `net.exe` with command-line arguments used to list or display information about computer connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement. +description: The following analytic identifies the execution of `net.exe` with command-line + arguments used to list or display information about computer connections. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on process names + and command-line executions. This activity can be significant as it indicates potential + network reconnaissance by adversaries or Red Teams, aiming to gather situational + awareness and Active Directory information. If confirmed malicious, this behavior + could allow attackers to map the network, identify critical assets, and plan further + attacks, potentially leading to data exfiltration or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (`process_net` OR (Processes.process_name="net.exe" + OR Processes.original_file_name="net.exe")) AND (Processes.process=*use) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_network_connection_discovery_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1049/ diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index b6fcefc3dc..90cdba60c0 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -1,6 +1,6 @@ name: Windows Network Share Interaction Via Net id: e51fbdb0-0be0-474f-92ea-d289f71a695e -version: 1 +version: 2 date: '2025-01-20' author: Dean Luxton status: production @@ -9,10 +9,31 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -description: The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND Processes.process IN ("*use *", "*view*") BY Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_via_net_filter`' -how_to_implement: The detection is based on data originating from either Endpoint Detection and Response (EDR) telemetry or EventCode 4688 with process command line logging enabled. These sources provide security-related telemetry from the endpoints. To implement this search, you must ingest logs that contain the process name, parent process, and complete command-line executions. These logs must be mapped to the Splunk Common Information Model (CIM) to normalize the field names capture the data within the datamodel schema. -known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. +description: The following analytic identifies network share discovery and collection + activities performed on Windows systems using the Net command. Attackers often use + network share discovery to identify accessible shared resources within a network, + which can be a precursor to privilege escalation or data exfiltration. By monitoring + Windows Event Logs for the usage of the Net command to list and interact with network + shares, this detection helps identify potential reconnaissance and collection activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes WHERE (`process_net` OR (Processes.process_name="net.exe" + OR Processes.original_file_name="net.exe")) AND Processes.process IN ("*use *", + "*view*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_network_share_interaction_via_net_filter`' +how_to_implement: The detection is based on data originating from either Endpoint + Detection and Response (EDR) telemetry or EventCode 4688 with process command line + logging enabled. These sources provide security-related telemetry from the endpoints. + To implement this search, you must ingest logs that contain the process name, parent + process, and complete command-line executions. These logs must be mapped to the + Splunk Common Information Model (CIM) to normalize the field names capture the data + within the datamodel schema. +known_false_positives: Administrators or power users may use this command. Additional + filters needs to be applied. references: - https://attack.mitre.org/techniques/T1135/ drilldown_searches: @@ -21,7 +42,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml index 4703844127..e2551b1dc2 100644 --- a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml +++ b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml @@ -1,6 +1,6 @@ name: Windows New Custom Security Descriptor Set On EventLog Channel id: c0e5dd5a-2117-41d5-a04c-82a762a86a38 -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production @@ -8,17 +8,30 @@ type: Anomaly description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within - the - "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\\CustomSD" + the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" AND Registry.registry_value_name=CustomSD BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name Registry.registry_path | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_custom_security_descriptor_set_on_eventlog_channel_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: None identified, setting up the "CustomSD" value is considered a legacy option and shouldn't be a common activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" + AND Registry.registry_value_name=CustomSD by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_new_custom_security_descriptor_set_on_eventlog_channel_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. If you are using Sysmon, you must have at least version 2.0 of + the official Sysmon TA. https://splunkbase.splunk.com/app/5709 +known_false_positives: None identified, setting up the "CustomSD" value is considered + a legacy option and shouldn't be a common activity. references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy - https://attack.mitre.org/techniques/T1562/002/ @@ -61,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml b/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml index df82e6aa8b..5c38b91742 100644 --- a/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml +++ b/detections/endpoint/windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml @@ -1,6 +1,6 @@ name: Windows New Deny Permission Set On Service SD Via Sc.EXE id: d0f6a5e5-dbfd-46e1-8bd5-2e2905947c33 -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production @@ -20,10 +20,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) Processes.process="*sdset *" Processes.process="*(D;*" Processes.process IN ("*;IU*", "*;S-1-5-4*", "*;SU*", "*;S-1-5-6*", "*;BA*", "*;S-1-5-32-544*", "*;SY*", "*;S-1-5-18*", "*;WD*", "*;S-1-1-0*", - "*;AU*", "*;S-1-5-11*", "*;LS*", "*;S-1-5-19*") by Processes.dest Processes.user - Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_deny_permission_set_on_service_sd_via_sc_exe_filter`' + "*;AU*", "*;S-1-5-11*", "*;LS*", "*;S-1-5-19*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_new_deny_permission_set_on_service_sd_via_sc_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -54,7 +58,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. risk_objects: - field: user type: user @@ -79,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml index 30f031abec..64ea66f1e1 100644 --- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml @@ -1,6 +1,6 @@ name: Windows New EventLog ChannelAccess Registry Value Set id: 16eb11bc-ef42-42e8-9d0c-d21e0fa15725 -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production @@ -8,8 +8,7 @@ type: Anomaly description: The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within - the - "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\\CustomSD" + the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from @@ -19,8 +18,9 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess - BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid - Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name Registry.registry_path + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_eventlog_channelaccess_registry_value_set_filter`' how_to_implement: To successfully implement this search, you must be ingesting data @@ -74,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml b/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml index 73f25dd448..9f8abeb132 100644 --- a/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml +++ b/detections/endpoint/windows_new_service_security_descriptor_set_via_sc_exe.yml @@ -1,6 +1,6 @@ name: Windows New Service Security Descriptor Set Via Sc.EXE id: cde00c31-042a-4307-bf70-25e471da56e9 -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production @@ -18,10 +18,13 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) Processes.process="*sdset - *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_new_service_security_descriptor_set_via_sc_exe_filter`' + *" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_new_service_security_descriptor_set_via_sc_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -52,7 +55,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. risk_objects: - field: user type: user @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index aae826157a..c95ab19161 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -1,6 +1,6 @@ name: Windows Ngrok Reverse Proxy Usage id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,8 +19,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", - "*tcp*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + "*tcp*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_ngrok_reverse_proxy_usage_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -83,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 4a5461615e..d5b900249d 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -1,6 +1,6 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=advancedrun.exe OR Processes.original_file_name=advancedrun.exe) Processes.process IN ("*EXEFilename*","*/cfg*","*RunAs*", - "*WindowState*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.original_file_name Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `windows_nirsoft_advancedrun_filter`' + "*WindowState*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_nirsoft_advancedrun_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index feb2c85d6f..e0f8792d82 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,6 +1,6 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,11 +17,14 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.original_file_name Processes.process_path - Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `is_nirsoft_software_macro` - | `windows_nirsoft_utilities_filter`' + as lastTime FROM datamodel=Endpoint.Processes by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `is_nirsoft_software_macro` | `windows_nirsoft_utilities_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -52,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml b/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml index e8917224bd..a16a4ca549 100644 --- a/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml +++ b/detections/endpoint/windows_njrat_fileless_storage_via_registry.yml @@ -1,6 +1,6 @@ name: Windows Njrat Fileless Storage via Registry id: a5fffbbd-271f-4980-94ed-4fbf17f0af1c -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ description: The following analytic detects suspicious registry modifications in breaches and further system compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\[kl]" - OR Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") by Registry.dest - Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name - Registry.registry_value_name | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `windows_njrat_fileless_storage_via_registry_filter`' + OR Registry.registry_value_data IN ("*[ENTER]*", "*[TAP]*", "*[Back]*") by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | `windows_njrat_fileless_storage_via_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.011/njrat_fileless_registry_entry/njrat_registry.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.011/njrat_fileless_registry_entry/njrat_registry.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index b6588d58e9..75b0600e06 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -1,6 +1,6 @@ name: Windows Non-System Account Targeting Lsass id: b1ce9a72-73cf-11ec-981b-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,9 +16,12 @@ description: The following analytic identifies non-SYSTEM accounts requesting ac data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*") - | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, - parent_process_path ,parent_process_id, TargetImage, GrantedAccess, SourceUser, - TargetUser | rename TargetUser as user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID + GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec + parent_process_guid parent_process_id parent_process_name parent_process_path process_exec + process_guid process_id process_name process_path signature signature_id user_id + vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -33,12 +36,12 @@ references: - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -50,7 +53,7 @@ rba: message: A process, $parent_process_path$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. risk_objects: - - field: user + - field: user_id type: user score: 64 - field: dest @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml index c8125ade83..52fdf52f61 100644 --- a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -1,22 +1,30 @@ name: Windows Obfuscated Files or Information via RAR SFX id: 4ab6862b-ce88-4223-96c0-f6da2cffb898 -version: 2 +version: 3 date: '2025-02-17' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 11 type: Anomaly status: production -description: The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery. -search: '`sysmon` EventCode=11 TargetFilename IN ("*__tmp_rar_sfx_access_check*") - | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename Computer - | rename Computer as dest - | rename TargetFilename as file_name - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_obfuscated_files_or_information_via_rar_sfx_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where rar sfx executable may be used. -known_false_positives: It can detect a third part utility software tool compiled to rar sfx. +description: The following analytic detects the creation of RAR Self-Extracting (SFX) + files by monitoring the generation of file related to rar sfx .tmp file creation + during sfx installation. This method leverages a heuristic to identify RAR SFX archives + based on specific markers that indicate a combination of executable code and compressed + RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized + or suspicious file creation events, which are often associated with malware packaging + or data exfiltration. Legitimate usage may include custom installers or compressed + file delivery. +search: '`sysmon` EventCode=11 TargetFilename IN ("*__tmp_rar_sfx_access_check*") + | stats count min(_time) as firstTime max(_time) as lastTime by action dest file_name + file_path process_guid process_id user user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_obfuscated_files_or_information_via_rar_sfx_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, TargetFilename, and eventcode 11 executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where rar sfx executable may be used. +known_false_positives: It can detect a third part utility software tool compiled to + rar sfx. references: - https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html drilldown_searches: @@ -25,11 +33,16 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A process commandline- [$Image$] that drops [$file_name$] on [$dest$]. + message: A process drops [$file_name$] on [$dest$]. risk_objects: - field: dest type: system diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index 74f8eee1e3..8bf400fcb4 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -1,6 +1,6 @@ name: Windows Odbcconf Hunting id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_hunting_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_odbcconf_hunting_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index f7a52f0e6a..3029733086 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -1,6 +1,6 @@ name: Windows Odbcconf Load DLL id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe - Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`' + Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_odbcconf_load_dll_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 7d234fd114..2c14735771 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -1,6 +1,6 @@ name: Windows Odbcconf Load Response File id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe - Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`' + Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_odbcconf_load_response_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index f6134c4079..5f04acee23 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -1,6 +1,6 @@ name: Windows Office Product Dropped Cab or Inf File id: dbdd251e-dd45-4ec9-a555-f5e151391746 -version: 2 +version: 3 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -14,19 +14,38 @@ description: The following analytic detects Office products writing .cab or .inf control over the affected system and potentially compromise sensitive data. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_office_products` by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` +- Windows Event Log Security 4688 AND Sysmon EventID 11 +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid - | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time - dest file_create_time file_name file_path process_name process_path process proc_guid] - | dedup file_create_time | table dest, process_name, process, file_create_time, - file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' + where Filesystem.file_name IN ("*.cab", "*.inf") by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | table action dest original_file_name parent_process + parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path + process process_exec process_guid process_hash process_id process_integrity_level + process_name process_path user user_id vendor_product file_access_time file_create_time + file_hash file_modify_time file_name file_path file_acl file_size firstTime lastTime + | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(file_access_time) as file_access_time values(file_create_time) + as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time + values(file_name) as file_name values(file_path) as file_path values(file_acl) as + file_acl values(file_size) as file_size by process_guid | where isnotnull(process) + AND isnotnull(file_name) | `windows_office_product_dropped_cab_or_inf_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` @@ -82,7 +101,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index fad1a08049..82da6b59e2 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -1,6 +1,6 @@ name: Windows Office Product Dropped Uncommon File id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 -version: 2 +version: 3 date: '2025-02-10' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: production @@ -15,16 +15,37 @@ description: The following analytic detects Microsoft Office applications droppi access, posing a severe threat to the environment. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where `process_office_products` by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name - IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", "*.vbe", "*.vbs") by _time - span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid - Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time - file_name file_path process_name process_path process process_guid] | dedup file_create_time - | table dest, process_name, process, file_create_time, file_name, file_path, process_guid +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where `process_office_products` + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", + "*.vbe", "*.vbs") by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) | `windows_office_product_dropped_uncommon_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -78,7 +99,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml index cb6ba413cc..097c7add7d 100644 --- a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml +++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml @@ -1,6 +1,6 @@ name: Windows Office Product Loaded MSHTML Module id: 4cc015c9-687c-40d2-adcc-46350f66e10c -version: 2 +version: 3 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk status: production @@ -18,8 +18,10 @@ search: '`sysmon` EventID=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") - | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, - loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image + ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid + process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loaded_mshtml_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml index a7ba40103b..9917e59163 100644 --- a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml +++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml @@ -1,6 +1,6 @@ name: Windows Office Product Loading Taskschd DLL id: d7297cfa-1f04-4714-bfbe-3679e0666959 -version: 2 +version: 3 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ data_source: search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path = "*\\taskschd.dll" - | stats min(_time) as firstTime max(_time) as lastTime count by user_id, dest, process_name,loaded_file, - loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image + ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid + process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_taskschd_dll_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml index e68293a575..ec9e26ddef 100644 --- a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml +++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml @@ -1,6 +1,6 @@ name: Windows Office Product Loading VBE7 DLL id: 7cfec906-2697-43f7-898b-83634a051d9a -version: 2 +version: 3 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ data_source: search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path IN ("*\\VBE7INTL.DLL", - "*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime - values(loaded_file) as loaded_file count by dest EventCode process_name process_guid - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_vbe7_dll_filter`' + "*\\VBE7.DLL", "*\\VBEUI.DLL") | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_office_product_loading_vbe7_dll_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -79,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml index 60bbc6b349..ca679c3213 100644 --- a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Child Process For Download id: f02b64b8-cbea-4f75-bf77-7a05111566b1 -version: 2 +version: 3 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN - ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' + ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_office_product_spawned_child_process_for_download_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml index 12ffb28a63..0dab8031e3 100644 --- a/detections/endpoint/windows_office_product_spawned_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Control id: 081c485d-ac8d-4bee-ad4c-525772fead4d -version: 3 +version: 4 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` - Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `windows_office_product_spawned_control_filter`' + Processes.process_name=control.exe by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_control_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -85,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 9f855ec660..fd33aac461 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned MSDT id: a3148fad-3734-4b7f-9a71-62f08d39fab1 -version: 3 +version: 4 date: '2025-02-10' author: Michael Haag, Teoderick Contreras, Splunk status: production @@ -19,9 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` - Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + Processes.process_name=msdt.exe by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_msdt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -88,7 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml index f44212470f..0cd7017143 100644 --- a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Rundll32 With No DLL id: f28e787e-69ca-480e-9f98-ab970e6d4bcc -version: 2 +version: 3 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` - `process_rundll32` (Processes.process!=*.dll*) by Processes.dest Processes.user - Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_rundll32_with_no_dll_filter`' + `process_rundll32` (Processes.process!=*.dll*) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `windows_office_product_spawned_rundll32_with_no_dll_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml index be1ba871e9..b7191fc8f4 100644 --- a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Uncommon Process id: 55d8741c-fa32-4692-8109-410304961eb8 -version: 2 +version: 3 date: '2025-02-10' author: Michael Haag, Teoderick Contreras, Splunk status: production @@ -21,9 +21,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` AND (`process_bitsadmin` OR `process_certutil` OR `process_cmd` OR `process_cscript` OR `process_mshta` OR `process_powershell` OR `process_regsvr32` OR `process_rundll32` - OR `process_wmic` OR `process_wscript`) by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + OR `process_wmic` OR `process_wscript`) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_uncommon_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -105,31 +108,26 @@ tags: tests: - name: True Positive Test - Macro attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test - IcedId attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - name: True Positive Test - TrickBot attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index 5a60c562ed..c45090b83e 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -1,6 +1,6 @@ name: Windows Outlook WebView Registry Modification id: 6e1ad5d4-d9af-496a-96ec-f31c11cd09f2 -version: 3 +version: 4 date: '2024-11-13' author: Michael Haag, Splunk data_source: @@ -21,9 +21,11 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path="*\\Software\\Microsoft\\Office\\*\\Outlook\\WebView\\*" OR Registry.registry_path="*\\Software\\Microsoft\\Office\\*\\Outlook\\Today") AND - Registry.registry_value_name="URL" by Registry.dest, Registry.user, Registry.registry_path - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` - | `windows_outlook_webview_registry_modification_filter`' + Registry.registry_value_name="URL" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_outlook_webview_registry_modification_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_papercut_ng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml index d647e50311..06ce9fd0d2 100644 --- a/detections/endpoint/windows_papercut_ng_spawn_shell.yml +++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml @@ -1,6 +1,6 @@ name: Windows PaperCut NG Spawn Shell id: a602d9a2-aaea-45f8-bf0f-d851168d61ca -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ description: The following analytic detects instances where the PaperCut NG appl of the affected environment. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=pc-app.exe - `process_cmd` OR `process_powershell` OR Processes.process_name=java.exe by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_papercut_ng_spawn_shell_filter`' + `process_cmd` OR `process_powershell` OR Processes.process_name=java.exe by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_papercut_ng_spawn_shell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/papercut/papercutng-app-spawn_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/papercut/papercutng-app-spawn_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml index 1fb1a5fb88..e1fa497628 100644 --- a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml +++ b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml @@ -1,6 +1,6 @@ name: Windows Parent PID Spoofing with Explorer id: 17f8f69c-5d00-4c88-9c6f-493bbdef20a1 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,12 @@ description: The following analytic identifies a suspicious `explorer.exe` proce access, privilege escalation, or persistent threats within the environment. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*explorer.exe*" - Processes.process="*/root,*" by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + Processes.process="*/root,*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_parent_pid_spoofing_with_explorer_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/explorer_root.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/explorer_root.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml index 61c3e4af03..1fbb801b3c 100644 --- a/detections/endpoint/windows_password_managers_discovery.yml +++ b/detections/endpoint/windows_password_managers_discovery.yml @@ -1,6 +1,6 @@ name: Windows Password Managers Discovery id: a3b3bc96-1c4f-4eba-8218-027cac739a48 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -21,11 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process = "*dir *" OR Processes.process = "*findstr*" AND Processes.process IN ( "*.kdbx*", "*credential*", "*key3.db*","*pass*", "*cred*", "*key4.db*", "*accessTokens*", "*access_tokens*", - "*.htpasswd*", "*Ntds.dit*") by Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name - Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_password_managers_discovery_filter`' + "*.htpasswd*", "*Ntds.dit*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_managers_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml index 42bbaeb646..a0f178e3ff 100644 --- a/detections/endpoint/windows_password_policy_discovery_with_net.yml +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -1,17 +1,42 @@ name: Windows Password Policy Discovery with Net id: e52f7865-be78-46bf-b7ed-150fbe447613 -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Mauricio Velazco, Nasreddine Bencherchali, Splunk status: production type: Hunting -description: The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network. +description: The following analytic identifies the execution of `net.exe` with command + line arguments aimed at obtaining the computer or domain password policy. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on process names + and command-line executions. This activity is significant as it indicates potential + reconnaissance efforts by adversaries to gather information about Active Directory + password policies. If confirmed malicious, this behavior could allow attackers to + understand password complexity requirements, aiding in brute-force or password-guessing + attacks, ultimately compromising user accounts and gaining unauthorized access to + the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts*" AND NOT Processes.process IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process + = "*accounts*" AND NOT Processes.process IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", + "*/MINPWAGE*", "*/UNIQUEPW*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet diff --git a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml index 432163293e..685c811982 100644 --- a/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml +++ b/detections/endpoint/windows_phishing_outlook_drop_dll_in_form_dir.yml @@ -1,10 +1,10 @@ name: Windows Phishing Outlook Drop Dll In FORM Dir id: fca01769-5163-4b3a-ae44-de874adfc9bc -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: -- Sysmon EventID 11 +- Sysmon EventID 1 AND Sysmon EventID 11 type: TTP status: production description: The following analytic detects the creation of a DLL file by an outlook.exe @@ -14,15 +14,38 @@ description: The following analytic detects the creation of a DLL file by an out an attempt to exploit CVE-2024-21378, where a custom MAPI form loads a potentially malicious DLL. If confirmed malicious, this could allow an attacker to execute arbitrary code, leading to further system compromise or data exfiltration. -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=outlook.exe by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid, _time [ | tstats `security_content_summariesonly` count min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name - ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" by _time - span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path - Filesystem.process_guid | `drop_dm_object_name(Filesystem)` | fields file_name file_path - process_name process_path process dest file_create_time _time process_guid] | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name ="*.dll" Filesystem.file_path = "*\\AppData\\Local\\Microsoft\\FORMS\\IPM*" + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(parent_process_exec) as parent_process_exec values(parent_process_guid) + as parent_process_guid values(parent_process_id) as parent_process_id values(parent_process_name) + as parent_process_name values(parent_process_path) as parent_process_path values(process) + as process values(process_exec) as process_exec values(process_hash) as process_hash + values(process_id) as process_id values(process_integrity_level) as process_integrity_level + values(process_name) as process_name values(process_path) as process_path values(user) + as user values(user_id) as user_id values(vendor_product) as vendor_product values(file_access_time) + as file_access_time values(file_create_time) as file_create_time values(file_hash) + as file_hash values(file_modify_time) as file_modify_time values(file_name) as file_name + values(file_path) as file_path values(file_acl) as file_acl values(file_size) as + file_size by process_guid | where isnotnull(process_name) AND isnotnull(file_name) + | `windows_phishing_outlook_drop_dll_in_form_dir_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, @@ -68,7 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/outlook_dropped_dll/outlook_phishing_form_dll.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566/outlook_dropped_dll/outlook_phishing_form_dll.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml index 13103b18d8..f3593f20b4 100644 --- a/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml +++ b/detections/endpoint/windows_phishing_pdf_file_executes_url_link.yml @@ -1,6 +1,6 @@ name: Windows Phishing PDF File Executes URL Link id: 2fa9dec8-9d8e-46d3-96c1-202c06f0e6e1 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,8 +19,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("AcroRd32.exe", "FoxitPDFReader.exe") Processes.process_name IN ("firefox.exe", - "chrome.exe", "iexplore.exe") by Processes.user Processes.parent_process_name Processes.process_name Processes.parent_process - Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` + "chrome.exe", "iexplore.exe") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phishing_pdf_file_executes_url_link_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml index 962ca663e7..2a962f747b 100644 --- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml +++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml @@ -1,6 +1,6 @@ name: Windows Phishing Recent ISO Exec Registry id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,9 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" OR Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img" - by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_phishing_recent_iso_exec_registry_filter`' + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_phishing_recent_iso_exec_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, @@ -55,7 +57,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 2d20510beb..cd8bc18e39 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -1,6 +1,6 @@ name: Windows Possible Credential Dumping id: e4723b92-7266-11ec-af45-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,9 +18,12 @@ search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe granted_access IN ("0x01 "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK - SERVICE") | stats count min(_time) as firstTime max(_time) as lastTime by dest, - SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser - | rename SourceUser as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + SERVICE") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace + EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID + SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access + parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path + process_exec process_guid process_id process_name process_path signature signature_id + user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -37,12 +40,12 @@ references: - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 drilldown_searches: -- name: View the detection results for - "$user$" and "$dest$" - search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' +- name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", +- name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -54,7 +57,7 @@ rba: message: A process, $SourceImage$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. risk_objects: - - field: user + - field: user_id type: user score: 64 - field: dest @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml b/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml index e74b775e06..ff98aec5e0 100644 --- a/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml +++ b/detections/endpoint/windows_powershell_add_module_to_global_assembly_cache.yml @@ -1,6 +1,6 @@ name: Windows PowerShell Add Module to Global Assembly Cache id: 3fc16961-97e5-4a5b-a079-e4ab0d9763eb -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the addition of a DLL to the Windows data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN("*system.enterpriseservices.internal.publish*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_add_module_to_global_assembly_cache_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -43,9 +44,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: PowerShell was used to install a module to the Global Assembly Cache on - $Computer$. + $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 64 threat_objects: [] @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/pwsh_publish_powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/pwsh_publish_powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml index cdcc825296..f211f67389 100644 --- a/detections/endpoint/windows_powershell_cryptography_namespace.yml +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -1,6 +1,6 @@ name: Windows Powershell Cryptography Namespace id: f8b482f4-6d62-49fa-a905-dfa15698317b -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,10 @@ description: The following analytic detects suspicious PowerShell script executi data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" - AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*")) | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID - | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powershell_cryptography_namespace_filter`' + AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*")) | fillnull | stats + count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_cryptography_namespace_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -28,13 +28,13 @@ known_false_positives: False positives should be limited. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -48,7 +48,7 @@ rba: - field: dest type: system score: 25 - - field: user + - field: user_id type: user score: 25 threat_objects: [] @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml index b770a22794..4f86464121 100644 --- a/detections/endpoint/windows_powershell_disable_http_logging.yml +++ b/detections/endpoint/windows_powershell_disable_http_logging.yml @@ -1,6 +1,6 @@ name: Windows PowerShell Disable HTTP Logging id: 27958de0-2857-43ca-9d4c-b255cf59dcab -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -17,8 +17,9 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN("*get-WebConfigurationProperty*","*Set-ItemProperty*") AND ScriptBlockText IN ("*httpLogging*","*Logfile.enabled*") AND ScriptBlockText - IN ("*dontLog*", "*false*") | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` + IN ("*dontLog*", "*false*") | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_disable_http_logging_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -46,9 +47,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A PowerShell Cmdlet related to disable or modifying a IIS HTTP logging - has occurred on $Computer$. + has occurred on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 64 threat_objects: [] @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml index acbed42b34..2d013aa1e4 100644 --- a/detections/endpoint/windows_powershell_export_certificate.yml +++ b/detections/endpoint/windows_powershell_export_certificate.yml @@ -1,6 +1,6 @@ name: Windows PowerShell Export Certificate id: 5e38ded4-c964-41f4-8cb6-4a1a53c6929f -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the use of the PowerShell Cmdlet `ex data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-certificate*") | - rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText dest user_id | `security_content_ctime(firstTime)` + rename Computer as dest | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_export_certificate_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -64,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 8a44eca228..6179990490 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -1,6 +1,6 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the use of the PowerShell cmdlet `ex data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*export-pfxcertificate*") - | rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText dest user_id | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powershell_export_pfxcertificate_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powershell_export_pfxcertificate_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml index 733a9addf8..7eb878ca39 100644 --- a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml +++ b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml @@ -1,6 +1,6 @@ name: Windows PowerShell Get CIMInstance Remote Computer id: d8c972eb-ed84-431a-8869-ca4bd83257d1 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk type: Anomaly @@ -14,9 +14,10 @@ description: The following analytic detects the use of the Get-CimInstance cmdle unauthorized remote access or information gathering by an attacker. If confirmed malicious, this could allow the attacker to collect sensitive data from remote systems, potentially leading to further exploitation or lateral movement within the network. -search: '`powershell` EventCode=4104 ScriptBlockText="*get-ciminstance*" AND ScriptBlockText="*computername*" | - stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText="*get-ciminstance*" AND ScriptBlockText="*computername*" + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_get_ciminstance_remote_computer_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -27,12 +28,12 @@ known_false_positives: This is meant to be a low risk RBA anomaly analytic or to references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.3 drilldown_searches: -- name: View the detection results for - "$Computer$" - search: '%original_detection_search% | search Computer = "$Computer$"' +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$") +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -41,10 +42,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A PowerShell Cmdlet Get-CIMInstnace was ran on $Computer$, attempting to - connect to a remote host. + message: A PowerShell Cmdlet Get-CIMInstnace was ran on $dest$, attempting to connect + to a remote host. risk_objects: - - field: Computer + - field: dest type: system score: 15 threat_objects: [] @@ -62,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml index 3a9bdc8cc3..8d44678edd 100644 --- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml +++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml @@ -1,6 +1,6 @@ name: Windows PowerShell IIS Components WebGlobalModule Usage id: 33fc9f6f-0ce7-4696-924e-a69ec61a3d57 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the usage of PowerShell Cmdlets - Ne data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText IN("*New-WebGlobalModule*","*Enable-WebGlobalModule*","*Set-WebGlobalModule*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_iis_components_webglobalmodule_usage_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -47,9 +48,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A PowerShell Cmdlet related to enabling, creating or modifying a IIS module - has occurred on $Computer$. + has occurred on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 64 threat_objects: [] @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/4104_windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml index b7e2a44f69..2f68c33e50 100644 --- a/detections/endpoint/windows_powershell_import_applocker_policy.yml +++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml @@ -1,6 +1,6 @@ name: Windows Powershell Import Applocker Policy id: 102af98d-0ca3-4aa4-98d6-7ab2b98b955a -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,11 +15,11 @@ description: The following analytic detects the import of Windows PowerShell App and persistence. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy - *" ScriptBlockText="* -XMLPolicy *" | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest - | rename UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_powershell_import_applocker_policy_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy*" + ScriptBlockText="* -XMLPolicy *" | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_powershell_import_applocker_policy_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -28,13 +28,13 @@ known_false_positives: administrators may execute this command that may cause so references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -43,12 +43,12 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ - with EventCode $EventCode$ on host $dest$ + on host $dest$ risk_objects: - field: dest type: system score: 49 - - field: user + - field: user_id type: user score: 49 threat_objects: [] @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml index 1e2d7ad33b..116ab5c17a 100644 --- a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml +++ b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml @@ -1,23 +1,23 @@ name: Windows Powershell Logoff User via Quser id: 6d70780d-4cfe-4820-bafd-1b43941986b5 -version: 2 +version: 3 date: '2025-02-10' author: Teoderick Contreras, Splunk data_source: - Powershell Script Block Logging 4104 type: Anomaly status: production -description: The following analytic detects the process of logging off a user through - the use of the quser and logoff commands. By monitoring for these commands, the - analytic identifies actions where a user session is forcibly terminated, which could - be part of an administrative task or a potentially unauthorized access attempt. - This detection helps identify potential misuse or malicious activity where a user’s - access is revoked without proper authorization, providing insight into potential - security incidents involving account management or session manipulation. -search: '`powershell` EventCode=4104 ScriptBlockText = "*quser*logoff*" | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText UserID - Computer | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powershell_logoff_user_via_quser_filter`' +description: "The following analytic detects the process of logging off a user through\ + \ the use of the quser and logoff commands. By monitoring for these commands, the\ + \ analytic identifies actions where a user session is forcibly terminated, which\ + \ could be part of an administrative task or a potentially unauthorized access attempt.\ + \ This detection helps identify potential misuse or malicious activity where a user\u2019\ + s access is revoked without proper authorization, providing insight into potential\ + \ security incidents involving account management or session manipulation." +search: '`powershell` EventCode=4104 ScriptBlockText = "*quser*logoff*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_logoff_user_via_quser_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -61,7 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_process_with_malicious_string.yml b/detections/endpoint/windows_powershell_process_with_malicious_string.yml index a69e23ee5d..5e85f877ad 100644 --- a/detections/endpoint/windows_powershell_process_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_process_with_malicious_string.yml @@ -1,25 +1,43 @@ name: Windows PowerShell Process With Malicious String id: 5df35d50-e1a3-4a52-a337-92e69d9b1b8a -version: 2 -date: '2024-12-19' +version: 3 +date: '2025-03-27' author: Steven Dick status: production type: TTP -description: The following analytic detects the execution of multiple offensive toolkits and commands through the process execution datamodel. This method captures commands given directly to powershell.exe, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment. -data_source: +description: The following analytic detects the execution of multiple offensive toolkits + and commands through the process execution datamodel. This method captures commands + given directly to powershell.exe, allowing for the identification of suspicious + activities including several well-known tools used for credential theft, lateral + movement, and persistence. If confirmed malicious, this could lead to unauthorized + access, privilege escalation, and potential compromise of sensitive information + within the environment. +data_source: - Windows Event Log Security 4688 - Sysmon EventID 1 - CrowdStrike ProcessRollup2 -search: |- - | tstats `security_content_summariesonly` count values(Processes.original_file_name) as original_file_name values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.dest Processes.process_name Processes.parent_process_name Processes.process - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | lookup malicious_powershell_strings command as process - | where isnotnull(match) - | `windows_powershell_process_with_malicious_string_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Unknown, possible usage by internal red team or powershell commands with overlap. +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ + \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` \nby\ + \ Processes.action Processes.dest Processes.original_file_name Processes.parent_process\ + \ Processes.parent_process_exec \nProcesses.parent_process_guid Processes.parent_process_id\ + \ Processes.parent_process_name \nProcesses.parent_process_path Processes.process\ + \ Processes.process_exec Processes.process_guid Processes.process_hash \nProcesses.process_id\ + \ Processes.process_integrity_level Processes.process_name Processes.process_path\ + \ \nProcesses.user Processes.user_id Processes.vendor_product \n| `drop_dm_object_name(Processes)`\ + \ \n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n\ + | lookup malicious_powershell_strings command as process\n| where isnotnull(match)\n\ + | `windows_powershell_process_with_malicious_string_filter`" +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Unknown, possible usage by internal red team or powershell + commands with overlap. references: - https://attack.mitre.org/techniques/T1059/001/ - https://github.com/PowerShellMafia/PowerSploit @@ -31,15 +49,22 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate PowerShell on $dest$ - search: '| from datamodel:Endpoint.Processes | search dest=$dest|s$ process_name=$process_name$ "*$match$*"' +- name: Investigate PowerShell on $dest$ + search: '| from datamodel:Endpoint.Processes | search dest=$dest|s$ process_name=$process_name$ + "*$match$*"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The user $user$ ran a known malicious PowerShell string matching *$match$* on $dest$ + message: The user $user$ ran a known malicious PowerShell string matching *$match$* + on $dest$ risk_objects: - field: user type: user @@ -51,12 +76,12 @@ rba: - field: process_name type: process_name tags: - analytic_story: + analytic_story: - Malicious PowerShell - asset_type: Endpoint - mitre_attack_id: + asset_type: Endpoint + mitre_attack_id: - T1059.001 - product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml index 63df593e37..08179bdc71 100644 --- a/detections/endpoint/windows_powershell_remotesigned_file.yml +++ b/detections/endpoint/windows_powershell_remotesigned_file.yml @@ -1,6 +1,6 @@ name: Windows Powershell RemoteSigned File id: f7f7456b-470d-4a95-9703-698250645ff4 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ description: The following analytic identifies the use of the "remotesigned" exe code execution, privilege escalation, or persistence within the environment. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="* - remotesigned *" Processes.process="* -File *" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powershell_remotesigned_file_filter`' + remotesigned *" Processes.process="* -File *" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powershell_remotesigned_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index 0aaa0d5614..a64d2a663c 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -1,6 +1,6 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,8 +18,9 @@ description: The following analytic detects potential malicious activities invol search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-ScheduledTask*", "*New-ScheduledTaskAction*", "*New-ScheduledTaskSettingsSet*", "*New-ScheduledTaskTrigger*", "*Register-ClusteredScheduledTask*", "*Register-ScheduledTask*", "*Set-ClusteredScheduledTask*", "*Set-ScheduledTask*", - "*Start-ScheduledTask*", "*Enable-ScheduledTask*") | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` + "*Start-ScheduledTask*", "*Enable-ScheduledTask*") | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product + EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_scheduletask_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -47,9 +48,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: The PowerShell cmdlets related to task creation, modification and start - occurred on $Computer$ by $user_id$. + occurred on $dest$ by $user_id$. risk_objects: - - field: Computer + - field: dest type: system score: 25 - field: user_id @@ -73,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/pwsh_scheduledtask.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/pwsh_scheduledtask.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml index bd8fc150ed..3f127db3a5 100644 --- a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml @@ -1,68 +1,75 @@ -name: Windows PowerShell Script Block With Malicious String -id: 0f09cedd-10f1-4b9f-bdea-7a8b06ea575d -version: 1 -date: '2024-12-19' -author: Steven Dick -status: production -type: TTP -description: The following analytic detects the execution of multiple offensive toolkits and commands by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment. -data_source: -- Powershell Script Block Logging 4104 -search: |- - `powershell` ScriptBlockText EventCode=4104 - | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command Values(OpCode) as reason values(Path) as file_name values(UserID) as user by ActivityID, Computer, EventCode - | eval command = mvjoin(command,"\n"), dest = Computer, signature = EventCode, signature_id = ActivityID - | lookup malicious_powershell_strings command - | where isnotnull(match) - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_powershell_script_block_with_malicious_string_filter` -how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: Unknown, possible usage by internal red team or powershell commands with overlap. -references: -- https://attack.mitre.org/techniques/T1059/001/ -- https://github.com/PowerShellMafia/PowerSploit -- https://github.com/PowerShellEmpire/ -- https://github.com/S3cur3Th1sSh1t/PowerSharpPack -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: Investigate PowerShell on $dest$ - search: '`powershell` ScriptBlockText EventCode=4104 Computer=$dest|s$ "*$match$*"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: The user $user$ ran a known malicious PowerShell string matching *$match$* on $dest$ - risk_objects: - - field: user - type: user - score: 70 - - field: dest - type: system - score: 70 - threat_objects: - - field: signature_id - type: signature -tags: - analytic_story: - - Malicious PowerShell - asset_type: Endpoint - mitre_attack_id: - - T1059.001 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: threat -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog +name: Windows PowerShell Script Block With Malicious String +id: 0f09cedd-10f1-4b9f-bdea-7a8b06ea575d +version: 2 +date: '2024-12-19' +author: Steven Dick +status: production +type: TTP +description: The following analytic detects the execution of multiple offensive toolkits + and commands by leveraging PowerShell Script Block Logging (EventCode=4104). This + method captures and logs the full command sent to PowerShell, allowing for the identification + of suspicious activities including several well-known tools used for credential + theft, lateral movement, and persistence. If confirmed malicious, this could lead + to unauthorized access, privilege escalation, and potential compromise of sensitive + information within the environment. +data_source: +- Powershell Script Block Logging 4104 +search: '`powershell` ScriptBlockText=* EventCode=4104 + | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product + | eval command = mvjoin(command,"\n") + | lookup malicious_powershell_strings command + | where isnotnull(match) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_script_block_with_malicious_string_filter`' +how_to_implement: The following analytic requires PowerShell operational logs to be + imported. Modify the powershell macro as needed to match the sourcetype or add index. + This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Unknown, possible usage by internal red team or powershell + commands with overlap. +references: +- https://attack.mitre.org/techniques/T1059/001/ +- https://github.com/PowerShellMafia/PowerSploit +- https://github.com/PowerShellEmpire/ +- https://github.com/S3cur3Th1sSh1t/PowerSharpPack +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: The user $user_id$ ran a known malicious PowerShell string matching *$match$* + on $dest$ + risk_objects: + - field: dest + type: system + score: 70 + threat_objects: + - field: signature_id + type: signature +tags: + analytic_story: + - Malicious PowerShell + asset_type: Endpoint + mitre_attack_id: + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml b/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml index 4ec8982c98..23f393878a 100644 --- a/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml +++ b/detections/endpoint/windows_powershell_wmi_win32_scheduledjob.yml @@ -1,6 +1,6 @@ name: Windows PowerShell WMI Win32 ScheduledJob id: 47c69803-2c09-408b-b40a-063c064cbb16 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk type: TTP @@ -14,10 +14,10 @@ description: The following analytic detects the use of the Win32_ScheduledJob WM block text analysis. Monitoring this activity is crucial as it may indicate malicious intent, especially if the class was enabled by an attacker. If confirmed malicious, this could allow attackers to persist in the environment by creating scheduled tasks. -search: '`powershell` EventCode=4104 ScriptBlockText="*win32_scheduledjob*" | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powershell_wmi_win32_scheduledjob_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText="*win32_scheduledjob*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_wmi_win32_scheduledjob_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powersploit_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml index cdd8803bc9..0a08d6999f 100644 --- a/detections/endpoint/windows_powersploit_gpp_discovery.yml +++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml @@ -1,6 +1,6 @@ name: Windows PowerSploit GPP Discovery id: 0130a0df-83a1-4647-9011-841e950ff302 -version: 7 +version: 8 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -16,9 +16,10 @@ description: The following analytic detects the execution of the Get-GPPPassword could allow an attacker to escalate privileges or move laterally within the network by exploiting exposed credentials. search: '`powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) - | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powersploit_gpp_discovery_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powersploit_gpp_discovery_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -45,12 +46,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Commandlets leveraged to discover GPP credentials were executed on $Computer$ + message: Commandlets leveraged to discover GPP credentials were executed on $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 56 - - field: user + - field: user_id type: user score: 56 threat_objects: [] @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml index 8c07de753d..10bba77c66 100644 --- a/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml +++ b/detections/endpoint/windows_powerview_ad_access_control_list_enumeration.yml @@ -1,6 +1,6 @@ name: Windows PowerView AD Access Control List Enumeration id: 39405650-c364-4e1e-a740-32a63ef042a6 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -15,9 +15,10 @@ description: The following analytic detects the execution of PowerView PowerShel Directory, potentially leading to privilege escalation. If confirmed malicious, attackers could exploit these permissions to gain unauthorized access or escalate their privileges within the network. -search: '`powershell` EventCode=4104 (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl* - ) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer - UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl*) + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_ad_access_control_list_enumeration_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -44,9 +45,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: PowerView AD acccess control list enumeration detected on $Computer$ + message: PowerView AD acccess control list enumeration detected on $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 20 threat_objects: [] @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml index 00983570e7..116cbd2094 100644 --- a/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml +++ b/detections/endpoint/windows_powerview_constrained_delegation_discovery.yml @@ -1,6 +1,6 @@ name: Windows PowerView Constrained Delegation Discovery id: 86dc8176-6e6c-42d6-9684-5444c6557ab3 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -17,9 +17,10 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*" OR ScriptBlockText = "*Get-NetComputer*") AND (ScriptBlockText = "*-TrustedToAuth*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powerview_constrained_delegation_discovery_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powerview_constrained_delegation_discovery_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -33,13 +34,13 @@ references: - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/constrained-delegation - https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -52,7 +53,7 @@ rba: - field: dest type: system score: 35 - - field: user + - field: user_id type: user score: 35 threat_objects: [] @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index 0fa3ee8fe5..877bc3cdeb 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -1,6 +1,6 @@ name: Windows PowerView Kerberos Service Ticket Request id: 970455a1-4ac2-47e1-a9a5-9e75443ddcb9 -version: 5 +version: 6 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the execution of the `Get-DomainSPNT to privilege escalation and further network compromise. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* | stats - count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id + user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powerview_spn_discovery.yml b/detections/endpoint/windows_powerview_spn_discovery.yml index 8abe7becab..3508d4f543 100644 --- a/detections/endpoint/windows_powerview_spn_discovery.yml +++ b/detections/endpoint/windows_powerview_spn_discovery.yml @@ -1,6 +1,6 @@ name: Windows PowerView SPN Discovery id: a7093c28-796c-4ebb-9997-e2c18b870837 -version: 5 +version: 6 date: '2025-02-10' author: Gowthamaraj Rajendran, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic detects the execution of the `Get-DomainUser data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText =*Get-NetUser* OR ScriptBlockText=*Get-DomainUser*) - ScriptBlockText= *-SPN* | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode ScriptBlockText Computer UserID | rename Computer as dest | rename - UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `windows_powerview_spn_discovery_filter`' + ScriptBlockText= *-SPN* | fillnull | stats count min(_time) as firstTime max(_time) + as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode + Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `windows_powerview_spn_discovery_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview-2/windows-powershell.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview-2/windows-powershell.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml index 6074178077..d6ff7099f1 100644 --- a/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml +++ b/detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml @@ -1,6 +1,6 @@ name: Windows PowerView Unconstrained Delegation Discovery id: fbf9e47f-e531-4fea-942d-5c95af7ed4d6 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -17,9 +17,10 @@ data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*" OR ScriptBlockText = "*Get-NetComputer*") AND (ScriptBlockText = "*-Unconstrained*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | rename Computer as dest | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_powerview_unconstrained_delegation_discovery_filter`' + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_powerview_unconstrained_delegation_discovery_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -32,13 +33,13 @@ references: - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation - https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -51,7 +52,7 @@ rba: - field: dest type: system score: 35 - - field: user + - field: user_id type: user score: 35 threat_objects: [] @@ -71,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml index 74c47622aa..41a48215ee 100644 --- a/detections/endpoint/windows_private_keys_discovery.yml +++ b/detections/endpoint/windows_private_keys_discovery.yml @@ -1,6 +1,6 @@ name: Windows Private Keys Discovery id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -22,9 +22,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process = "*dir *" OR Processes.process = "*findstr*" AND Processes.process IN ( "*.rdg*", "*.gpg*", "*.pgp*", "*.p12*", "*.der*", "*.csr*", "*.cer*", "*.ovpn*", "*.key*", "*.ppk*", - "*.p12*", "*.pem*", "*.pfx*", "*.p7b*", "*.asc*") by Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name - Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user + "*.p12*", "*.pem*", "*.pfx*", "*.p7b*", "*.asc*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_private_keys_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml index c94417e9e5..6994b12557 100644 --- a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml +++ b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml @@ -1,6 +1,6 @@ name: Windows Privilege Escalation Suspicious Process Elevation id: 6a80300a-9f8a-4f22-bd3e-09ca577cfdfc -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick status: production @@ -14,19 +14,19 @@ description: The following analytic detects when a process running with low or m attacker to execute code with higher privileges, potentially leading to full system compromise and persistent access. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- Sysmon EventID 1 AND Sysmon EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime from datamodel=Endpoint.Processes where Processes.process_integrity_level IN ("low","medium","high") NOT Processes.user IN ("*SYSTEM","*LOCAL SERVICE","*NETWORK SERVICE","DWM-*","*$") - by Processes.dest, Processes.user, Processes.parent_process_guid, Processes.parent_process, - Processes.parent_process_name Processes.process_name Processes.process, Processes.process_path, - Processes.process_guid, Processes.process_integrity_level, Processes.process_current_directory + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | eval join_guid = process_guid, integrity_level = CASE(match(process_integrity_level,"low"),1,match(process_integrity_level,"medium"),2,match(process_integrity_level,"high"),3,match(process_integrity_level,"system"),4,true(),0) | rename user as src_user, parent_process* as orig_parent_process*, process* as - parent_process* | join max=0 dest join_guid [| tstats `security_content_summariesonly` + parent_process* | join max=0 dest join_guid [| tstats `security_content_summariesonly` count max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_integrity_level IN ("system") NOT Processes.user IN ("*SYSTEM","*LOCAL SERVICE","*NETWORK SERVICE","DWM-*","*$")) OR (Processes.process_integrity_level IN ("high","system") AND (Processes.parent_process_path @@ -40,8 +40,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime parent_process_path, parent_process_guid, parent_process_integrity_level, parent_process_current_directory, process_name, process, process_path, process_guid, process_integrity_level, process_current_directory, orig_parent_process_name, orig_parent_process, orig_parent_process_guid, firstTime, - lastTime, count | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_privilege_escalation_suspicious_process_elevation_filter`' + lastTime, count | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_privilege_escalation_suspicious_process_elevation_filter`' how_to_implement: Target environment must ingest process execution data sources such as Windows process monitoring and/or Sysmon EID 1. known_false_positives: False positives may be generated by administrators installing @@ -98,8 +98,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml index aa2a71407c..f5a19732a0 100644 --- a/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml +++ b/detections/endpoint/windows_privilege_escalation_system_process_without_system_parent.yml @@ -1,6 +1,6 @@ name: Windows Privilege Escalation System Process Without System Parent id: 5a5351cd-ba7e-499e-ad82-2ce160ffa637 -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production @@ -13,16 +13,14 @@ description: The following analytic detects any system integrity level process s execute arbitrary code, and potentially compromise the entire environment. data_source: - Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 search: '`sysmon` EventCode=1 IntegrityLevel="system" ParentUser=* NOT ParentUser IN ("*SYSTEM","*LOCAL SERVICE","*NETWORK SERVICE","*DWM-*","*$","-") | eval src_user = replace(ParentUser,"^[^\\\]+\\\\","") | stats count min(_time) as firstTime max(_time) - as lastTime values(process_name) as process_name values(process) as process, values(process_path) - as process_path, values(process_current_directory) as process_current_directory - values(parent_process) as parent_process by dest, user, src_user, parent_process_name, - parent_process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_privilege_escalation_system_process_without_system_parent_filter`' + as lastTime by action dest original_file_name parent_process parent_process_exec + parent_process_guid parent_process_id parent_process_name parent_process_path process + process_exec process_guid process_hash process_id process_integrity_level process_name + process_path user user_id vendor_product src_user | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `windows_privilege_escalation_system_process_without_system_parent_filter`' how_to_implement: Target environment must ingest sysmon data, specifically Event ID 1 with process integrity and parent user data. known_false_positives: Unknown @@ -74,8 +72,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml index 8fc375b1ca..a28177f659 100644 --- a/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml +++ b/detections/endpoint/windows_privilege_escalation_user_process_spawn_system_process.yml @@ -1,6 +1,6 @@ name: Windows Privilege Escalation User Process Spawn System Process id: c9687a28-39ad-43c6-8bcf-eaf061ba0cbe -version: 5 +version: 6 date: '2024-12-10' author: Steven Dick status: production @@ -14,18 +14,18 @@ description: The following analytic detects when a process with low, medium, or access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- Sysmon EventID 1 AND Sysmon EventID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime from datamodel=Endpoint.Processes where Processes.process_integrity_level IN ("low","medium","high") NOT Processes.user IN ("*SYSTEM","*LOCAL SERVICE","*NETWORK SERVICE","DWM-*","*$") AND Processes.process_path IN ("*\\\\*","*\\Users\\*","*\\Temp\\*","*\\ProgramData\\*") - by Processes.dest, Processes.user, Processes.parent_process_guid, Processes.parent_process, - Processes.parent_process_name Processes.process_name Processes.process, Processes.process_path, - Processes.process_guid, Processes.process_integrity_level, Processes.process_current_directory + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | eval join_guid = process_guid | join max=0 - dest join_guid [| tstats `security_content_summariesonly` count max(_time) as lastTime + dest join_guid [| tstats `security_content_summariesonly` count max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_integrity_level IN ("system") AND Processes.parent_process_path IN ("*\\\\*","*\\Users\\*","*\\Temp\\*","*\\ProgramData\\*") by Processes.dest, Processes.user, Processes.parent_process_guid, Processes.process_name, @@ -35,7 +35,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime parent_process_guid, process, process_name, process_guid, process_integrity_level,process_path, process_current_directory, system_process_name, system_process, system_process_path, system_process_integrity_level, system_process_current_directory, system_user, firstTime, - lastTime, count | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + lastTime, count | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_privilege_escalation_user_process_spawn_system_process_filter`' how_to_implement: Target environment must ingest sysmon data, specifically Event ID 15. @@ -61,7 +61,7 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: The user $user$ launched the process $process_name$ which spawned a system - level integrity process $system_process$ . + level integrity process. risk_objects: - field: dest type: system @@ -89,8 +89,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_process_commandline_discovery.yml b/detections/endpoint/windows_process_commandline_discovery.yml index 0d1f5ce24d..58107cacaf 100644 --- a/detections/endpoint/windows_process_commandline_discovery.yml +++ b/detections/endpoint/windows_process_commandline_discovery.yml @@ -1,6 +1,6 @@ name: Windows Process Commandline Discovery id: 67d2a52e-a7e2-4a5d-ae44-a21212048bc2 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,14 @@ description: The following analytic detects the use of Windows Management Instru further exploitation or lateral movement. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process= - "* process *" Processes.process= "* get commandline *" by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_process_commandline_discovery_filter`' + "* process *" Processes.process= "* get commandline *" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_process_commandline_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1057/process_commandline_discovery/wmic-cmdline-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1057/process_commandline_discovery/wmic-cmdline-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_executed_from_removable_media.yml b/detections/endpoint/windows_process_executed_from_removable_media.yml index 0a2f39787c..11aad3169f 100644 --- a/detections/endpoint/windows_process_executed_from_removable_media.yml +++ b/detections/endpoint/windows_process_executed_from_removable_media.yml @@ -1,32 +1,52 @@ name: Windows Process Executed From Removable Media id: b483804a-4cc0-49a4-9f00-ac29ba844d08 -version: 2 -date: '2025-01-17' +version: 3 +date: '2025-03-27' author: Steven Dick status: production type: Anomaly -description: This analytic is used to identify when a removable media device is attached to a machine and then a process is executed from the same drive letter assigned to the removable media device. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration. -data_source: -- Windows Event Log Security 4688 -- Sysmon EventID 1 -- Sysmon EventID 12 -- Sysmon EventID 13 -- CrowdStrike ProcessRollup2 -search: |- - | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_current_directory=* AND NOT Processes.process_current_directory IN ("C:\\*","*\\sysvol\\*") by Processes.dest Processes.user Processes.process_name Processes.parent_process_name Processes.process_current_directory - | `drop_dm_object_name(Processes)` - | rex field=process_current_directory "^(?[^\\\]+\\\)" - | where isnotnull(object_handle) - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | join dest,object_handle - [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_data="*:\\*" AND Registry.registry_path="*USBSTOR*" AND Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*") by Registry.dest,Registry.registry_value_data,Registry.registry_path - | `drop_dm_object_name(Registry)` - | eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&"),2),"PROD_","") - ] - | `windows_process_executed_from_removable_media_filter` -how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys as well as Process Execution commands. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model. This analytic joins the Process and Registry datamodels together based on the drive letter extract to the "object_handle" field from both datasets. -known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate. +description: This analytic is used to identify when a removable media device is attached + to a machine and then a process is executed from the same drive letter assigned + to the removable media device. Adversaries and Insider Threats may use removable + media devices for several malicious activities, including initial access, execution, + and exfiltration. +data_source: +- Sysmon EventID 1 AND Sysmon EventID 12 +- Sysmon EventID 1 AND Sysmon EventID 13 +search: "| tstats `security_content_summariesonly` count values(Processes.process)\ + \ as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes\ + \ where Processes.process_current_directory=* AND NOT Processes.process_current_directory\ + \ IN (\"C:\\\\*\",\"*\\\\sysvol\\\\*\") \nby Processes.action Processes.dest Processes.original_file_name\ + \ Processes.parent_process Processes.parent_process_exec \nProcesses.parent_process_guid\ + \ Processes.parent_process_id Processes.parent_process_name \nProcesses.parent_process_path\ + \ Processes.process Processes.process_exec Processes.process_guid Processes.process_hash\ + \ \nProcesses.process_id Processes.process_integrity_level Processes.process_name\ + \ Processes.process_path \nProcesses.user Processes.user_id Processes.vendor_product\ + \ Processes.process_current_directory\n| `drop_dm_object_name(Processes)` \n| rex\ + \ field=process_current_directory \"^(?[^\\\\\\]+\\\\\\)\" \n| where\ + \ isnotnull(object_handle) \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\ + \ \n| join dest,object_handle \n [| tstats `security_content_summariesonly` count\ + \ values(Registry.action) as action values(Registry.process_guid) as process_guid\ + \ values(Registry.process_id) as process_id values(Registry.registry_hive) as registry_hive\ + \ values(Registry.registry_key_name) as registry_key_name values(Registry.registry_value_name)\ + \ as registry_value_name values(Registry.registry_value_type) as registry_value_type\ + \ values(Registry.status) as status values(Registry.user) as user values(Registry.vendor_product)\ + \ as vendor_product from datamodel=Endpoint.Registry where Registry.registry_value_data=\"\ + *:\\\\*\" AND Registry.registry_path=\"*USBSTOR*\" AND Registry.registry_path IN\ + \ (\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows Portable Devices\\\\Devices\\\\*\"\ + ,\"HKLM\\\\System\\\\CurrentControlSet\\\\Enum\\\\SWD\\\\WPDBUSENUM\\\\*\") by Registry.dest,Registry.registry_value_data,\ + \ Registry.registry_path \n | `drop_dm_object_name(Registry)` \n | eval object_handle\ + \ = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path,\ + \ \"??\"),1),\"&\"),2),\"PROD_\",\"\")\n ]\n| `windows_process_executed_from_removable_media_filter`" +how_to_implement: To successfully implement this search, you must ingest endpoint + logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ + or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys as well as Process + Execution commands. Ensure that the field from the event logs is being mapped to + the proper fields in the Endpoint.Registry data model. This analytic joins the Process + and Registry datamodels together based on the drive letter extract to the "object_handle" + field from both datasets. +known_false_positives: Legitimate USB activity will also be detected. Please verify + and investigate as appropriate. references: - https://attack.mitre.org/techniques/T1200/ - https://www.cisa.gov/news-events/news/using-caution-usb-drives @@ -37,15 +57,21 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$" , "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$" + , "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate USB events on $dest$ +- name: Investigate USB events on $dest$ search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_current_directory=$object_handle$*' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The process [$process_name$] was launched using files on a removable storage device named [$object_name$] by [$user$] on $dest$ + message: The process [$process_name$] was launched using files on a removable storage + device named [$object_name$] by [$user$] on $dest$ risk_objects: - field: user type: user @@ -59,16 +85,16 @@ rba: - field: object_name type: registry_value_name - field: object_handle - type: registry_value_text + type: registry_value_text tags: - analytic_story: + analytic_story: - Data Protection asset_type: Endpoint - mitre_attack_id: + mitre_attack_id: - T1200 - T1025 - T1091 - product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud diff --git a/detections/endpoint/windows_process_execution_from_programdata.yml b/detections/endpoint/windows_process_execution_from_programdata.yml index 075bd21a58..33d9358fa4 100644 --- a/detections/endpoint/windows_process_execution_from_programdata.yml +++ b/detections/endpoint/windows_process_execution_from_programdata.yml @@ -1,23 +1,32 @@ name: Windows Process Execution From ProgramData id: 237016fa-d8e6-47b4-80f9-70c4d42c72c0 -version: 1 -date: '2025-03-13' +version: 2 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies processes running from file paths within the ProgramData directory, a common location abused by adversaries for executing malicious code while evading detection. Threat actors often drop and execute payloads from this directory to bypass security controls, as it typically has write permissions for standard users. While this behavior can indicate malware execution or persistence techniques, it is important to note that some legitimate software, installers, and update mechanisms also run from ProgramData, leading to potential false positives. Security teams should validate detections by correlating with other indicators, such as unusual parent processes, unsigned binaries, or anomalous network activity. +description: The following analytic identifies processes running from file paths within + the ProgramData directory, a common location abused by adversaries for executing + malicious code while evading detection. Threat actors often drop and execute payloads + from this directory to bypass security controls, as it typically has write permissions + for standard users. While this behavior can indicate malware execution or persistence + techniques, it is important to note that some legitimate software, installers, and + update mechanisms also run from ProgramData, leading to potential false positives. + Security teams should validate detections by correlating with other indicators, + such as unusual parent processes, unsigned binaries, or anomalous network activity. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes - where Processes.process_path = "*:\\ProgramData\\*" - by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*:\\ProgramData\\*" + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_execution_from_programdata_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -47,8 +56,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious process $process_name$ running from a process path- - $process_path$ on host- $dest$ + message: Suspicious process $process_name$ running from a process path- $process_path$ + on host- $dest$ risk_objects: - field: dest type: system diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml index 5958a73865..d03c4d54d5 100644 --- a/detections/endpoint/windows_process_execution_in_temp_dir.yml +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -1,23 +1,30 @@ name: Windows Process Execution in Temp Dir id: f6fbe929-4187-4ba4-901e-8a34be838443 -version: 1 +version: 2 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies processes running from %temp% directory file paths. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint - data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment. +description: The following analytic identifies processes running from %temp% directory + file paths. It leverages data from Endpoint Detection and Response (EDR) agents, + focusing on specific process paths within the Endpoint data model. This activity + is significant because adversaries often use unconventional file paths to execute + malicious code without requiring administrative privileges. If confirmed malicious, + this behavior could indicate an attempt to bypass security controls, leading to + unauthorized software execution, potential system compromise, and further malicious + activities within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_path IN("*\\temp\\*") - by Processes.parent_process_name Processes.process_name Processes.parent_process Processes.process_path Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\temp\\*") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_execution_in_temp_dir_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -51,8 +58,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious process $process_name$ running from temp directory- - $process_path$ on host- $dest$ + message: Suspicious process $process_name$ running from temp directory- $process_path$ + on host- $dest$ risk_objects: - field: dest type: system @@ -81,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/process_temp_path/process_temp_path.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/process_temp_path/process_temp_path.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml b/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml index 6f38c5850b..cd8c16435f 100644 --- a/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml +++ b/detections/endpoint/windows_process_injection_in_non_service_searchindexer.yml @@ -1,6 +1,6 @@ name: Windows Process Injection In Non-Service SearchIndexer id: d131673f-ede1-47f2-93a1-0108d3e7fafd -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ description: The following analytic identifies instances of the searchindexer.ex information, and communicate with command and control servers. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - != services.exe Processes.process_name=searchindexer.exe by Processes.dest Processes.user - Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_in_non_service_searchindexer_filter`' + != services.exe Processes.process_name=searchindexer.exe by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_process_injection_in_non_service_searchindexer_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -71,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/non-service-searchindexer/seaarch-indexer-non-service.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/non-service-searchindexer/seaarch-indexer-non-service.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index 0ad328b2e2..c80ae393d8 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -4,7 +4,7 @@ version: 1 date: '2025-03-19' author: 0xC0FFEEEE, Github Community type: Anomaly -status: production +status: production data_source: - Sysmon EventID 10 description: The following analytic detects process injection into executables that are commonly abused using @@ -16,12 +16,11 @@ description: The following analytic detects process injection into executables t allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. search: '`sysmon` EventCode=10 TargetImage IN ("*\\notepad.exe", "*\\wordpad.exe", "*\\calc.exe", "*\\mspaint.exe", "*\\lsass.exe", "*\\svchost.exe", "*\\backgroundtaskhost.exe", "*\\dllhost.exe", "*\\regsvr32.exe", "*\\searchprotocolhost.exe", "*\\werfault.exe", "*\\wuauclt.exe", "*\\spoolsv.exe", "*\\chrome.exe", "*\\edge.exe", "*\\firefox.exe") NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*", "*\\Program Files (x86)\\*")) GrantedAccess IN ("0x40","0x1fffff", "0x1f3fff") - | stats values(user) as user, min(_time) as firstTime, max(_time) as lastTime, count by dest SourceImage TargetImage GrantedAccess CallTrace - | eval CallTrace=split(CallTrace, "|") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | table firstTime lastTime dest user SourceImage TargetImage GrantedAccess CallTrace count - | `windows_process_injection_into_commonly_abused_processes_filter`' +| stats values(user) as user, min(_time) as firstTime, max(_time) as lastTime, count by dest user_id parent_process_name parent_process_guid process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace +| eval CallTrace=split(CallTrace, "|") +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table firstTime lastTime dest user_id parent_process_name parent_process_guid process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace| `windows_process_injection_into_commonly_abused_processes_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/endpoint/windows_process_injection_into_notepad.yml index 8a4a772575..9d6153bc6d 100644 --- a/detections/endpoint/windows_process_injection_into_notepad.yml +++ b/detections/endpoint/windows_process_injection_into_notepad.yml @@ -1,6 +1,6 @@ name: Windows Process Injection into Notepad id: b8340d0f-ba48-4391-bea7-9e793c5aae36 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk type: Anomaly @@ -17,8 +17,12 @@ description: The following analytic detects process injection into Notepad.exe u or persistent access within the environment. search: '`sysmon` EventCode=10 TargetImage IN (*\\notepad.exe) NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*")) GrantedAccess IN ("0x40","0x1fffff") - | stats count min(_time) as firstTime max(_time) as lastTime by dest SourceImage - TargetImage GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID + GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec + parent_process_guid parent_process_id parent_process_name parent_process_path process_exec + process_guid process_id process_name process_path signature signature_id user_id + vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_into_notepad_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -70,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml index 4c35239780..b7d84afb5d 100644 --- a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml @@ -1,6 +1,6 @@ name: Windows Process Injection Of Wermgr to Known Browser id: aec755a5-3a2c-4be0-ab34-6540e68644e9 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ data_source: - Sysmon EventID 8 search: '`sysmon` EventCode=8 SourceImage = "*\\wermgr.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) - as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGuid - SourceProcessId StartAddress StartFunction TargetProcessGuid TargetProcessId EventCode - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_process_injection_of_wermgr_to_known_browser_filter`' + as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID + SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule + TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process_exec process_guid + process_id process_name process_path signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_of_wermgr_to_known_browser_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 48d56aec9f..62c1aeb33b 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,6 +1,6 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,12 @@ search: '`sysmon` EventCode=8 TargetImage IN ("*\\Taskmgr.exe", "*\\calc.exe", " "*\\rdpclip.exe", "*\\explorer.exe", "*\\wermgr.exe", "*\\ping.exe", "*\\OneDriveSetup.exe", "*\\dxdiag.exe", "*\\mobsync.exe", "*\\msra.exe", "*\\xwizard.exe","*\\cmd.exe", "*\\powershell.exe") | stats count min(_time) as firstTime max(_time) as lastTime - by TargetImage TargetProcessId SourceProcessId EventCode StartAddress SourceImage - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_process_injection_remote_thread_filter`' + by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId + StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId + UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name + parent_process_path process_exec process_guid process_id process_name process_path + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_process_injection_remote_thread_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts like remote thread EventCode=8 of sysmon. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon @@ -70,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml index f639726685..adf3f7710c 100644 --- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml +++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml @@ -1,6 +1,6 @@ name: Windows Process Injection Wermgr Child Process id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "wermgr.exe" AND NOT (Processes.process_name IN ("WerFaultSecure.exe", "wermgr.exe", - "WerFault.exe")) by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_process_injection_wermgr_child_process_filter`' + "WerFault.exe")) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_wermgr_child_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index 3034d4db52..889b4ecb32 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -1,6 +1,6 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,11 @@ data_source: - Sysmon EventID 8 search: '`sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) - as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid - TargetProcessId SourceProcessId StartAddress EventCode dest | `security_content_ctime(firstTime)` + as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid + SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid + TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process_exec process_guid process_id process_name + process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_with_public_source_path_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model @@ -42,7 +45,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index ea90eee485..f3e83be25f 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -1,6 +1,6 @@ name: Windows Process With NamedPipe CommandLine id: e64399d4-94a8-11ec-a9da-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,11 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*" - NOT (Processes.process_path IN ("*\\program files*")) by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.original_file_name - Processes.process_id Processes.parent_process_path Processes.process_guid Processes.parent_process_id - Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`' + NOT (Processes.process_path IN ("*\\program files*")) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_process_with_namedpipe_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml b/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml index 62d783e320..f9635d3604 100644 --- a/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml +++ b/detections/endpoint/windows_process_with_netexec_command_line_parameters.yml @@ -1,22 +1,47 @@ name: Windows Process With NetExec Command Line Parameters id: adbff89c-c1f2-4a2e-88a4-b5e645856510 -version: 5 -date: '2025-03-03' +version: 6 +date: '2025-03-27' author: Steven Dick, Github Community status: production type: TTP -description: The following analytic detects the use of NetExec (formally CrackmapExec) a toolset used for post-exploitation enumeration and attack within Active Directory environments through command line parameters. It leverages Endpoint Detection and Response (EDR) data to identify specific command-line arguments associated with actions like ticket manipulation, kerberoasting, and password spraying. This activity is significant as NetExec is used by adversaries to exploit Kerberos for privilege escalation and lateral movement. If confirmed malicious, this could lead to unauthorized access, persistence, and potential compromise of sensitive information within the network. -data_source: +description: The following analytic detects the use of NetExec (formally CrackmapExec) + a toolset used for post-exploitation enumeration and attack within Active Directory + environments through command line parameters. It leverages Endpoint Detection and + Response (EDR) data to identify specific command-line arguments associated with + actions like ticket manipulation, kerberoasting, and password spraying. This activity + is significant as NetExec is used by adversaries to exploit Kerberos for privilege + escalation and lateral movement. If confirmed malicious, this could lead to unauthorized + access, persistence, and potential compromise of sensitive information within the + network. +data_source: - Windows Event Log Security 4688 - Sysmon EventID 1 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.parent_process) as Processes.parent_process, values(Processes.process) as Processes.process values(Processes.process_current_directory) AS process_current_directory, values(Processes.process_id) as Processes.process_id, values(Processes.process_guid) as Processes.process_guid, count min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.os="Linux" Processes.process_name IN ("nxc.exe") OR Processes.original_file_name IN ("nxc.exe") OR (Processes.process IN ("* smb *","* ssh *","* ldap *","* ftp *","* wmi *","* winrm *","* rdp *","* vnc *","* mssql *","* nfs *") AND ((Processes.process = "* -p *" AND Processes.process = "* -u *") OR Processes.process IN ("* -x *","* -M *","* --*"))) BY _time span=1h Processes.user Processes.dest Processes.process_name Processes.parent_process_name -|`drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `windows_process_with_netexec_command_line_parameters_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Although unlikely, legitimate applications may use the same command line parameters as NetExec. Filter as needed. +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime, + max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.os="Linux" + Processes.process_name IN ("nxc.exe") OR Processes.original_file_name IN ("nxc.exe") + OR (Processes.process IN ("* smb *","* ssh *","* ldap *","* ftp *","* wmi *","* + winrm *","* rdp *","* vnc *","* mssql *","* nfs *") AND ((Processes.process = "* + -p *" AND Processes.process = "* -u *") OR Processes.process IN ("* -x *","* -M + *","* --*"))) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_process_with_netexec_command_line_parameters_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Although unlikely, legitimate applications may use the same + command line parameters as NetExec. Filter as needed. references: - https://www.netexec.wiki/ - https://www.johnvictorwolfe.com/2024/07/21/the-successor-to-crackmapexec/ @@ -27,16 +52,22 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate processes on $dest$ - search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = $process_name$' +- name: Investigate processes on $dest$ + search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = + $process_name$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: +rba: message: NetExec command line parameters were used on $dest$ by $user$ - risk_objects: + risk_objects: - field: user type: user score: 64 @@ -47,15 +78,15 @@ rba: - field: parent_process_name type: parent_process_name tags: - analytic_story: + analytic_story: - Active Directory Kerberos Attacks - Active Directory Privilege Escalation asset_type: Endpoint - mitre_attack_id: + mitre_attack_id: - T1550.003 - T1558.003 - T1558.004 - product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud diff --git a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml index 454d390356..3693a60cd8 100644 --- a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml +++ b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml @@ -1,6 +1,6 @@ name: Windows Process Writing File to World Writable Path id: c051b68c-60f7-4022-b3ad-773bec7a225b -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk data_source: [] @@ -46,6 +46,7 @@ references: tags: analytic_story: - APT29 Diplomatic Deceptions with WINELOADER + - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint mitre_attack_id: - T1218.005 diff --git a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml index 505fbe4854..eae5e9142c 100644 --- a/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml +++ b/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml @@ -1,6 +1,6 @@ name: Windows Processes Killed By Industroyer2 Malware id: d8bea5ca-9d4a-4249-8b56-64a619109835 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,10 @@ description: The following analytic detects the termination of specific processe data_source: - Sysmon EventID 5 search: '`sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") - | stats min(_time) as firstTime max(_time) as lastTime count by process_name process - process_path process_guid process_id EventCode dest user_id | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `windows_processes_killed_by_industroyer2_malware_filter`' + | stats min(_time) as firstTime max(_time) as lastTime count by dest process process_exec + process_guid process_id process_name process_path signature signature_id user_id + vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_processes_killed_by_industroyer2_malware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/industroyer2/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml index b55caf7791..31a5b892bc 100644 --- a/detections/endpoint/windows_protocol_tunneling_with_plink.yml +++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml @@ -1,6 +1,6 @@ name: Windows Protocol Tunneling with Plink id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -24,8 +24,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=plink.exe OR Processes.process_name=pvhost.exe OR Processes.original_file_name=Plink) AND Processes.process IN ("*-R *", "*-L *", "*-D *", "*-l *", "*-N *", "*-P *", "*-pw - *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + *") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_protocol_tunneling_with_plink_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -90,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml index 639a557efe..f732f7faea 100644 --- a/detections/endpoint/windows_proxy_via_netsh.yml +++ b/detections/endpoint/windows_proxy_via_netsh.yml @@ -1,6 +1,6 @@ name: Windows Proxy Via Netsh id: c137bfe8-6036-4cff-b77b-4e327dd0a1cf -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,14 @@ description: The following analytic identifies the use of netsh.exe to configure security risk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process - = "* portproxy *" Processes.process = "* v4tov4 *" by Processes.parent_process_name - Processes.parent_process Processes.original_file_name Processes.process_name Processes.process - Processes.user Processes.dest |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `windows_proxy_via_netsh_filter`' + = "* portproxy *" Processes.process = "* v4tov4 *" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `windows_proxy_via_netsh_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_proxy_via_registry.yml b/detections/endpoint/windows_proxy_via_registry.yml index 65c83c6ae6..81f617119a 100644 --- a/detections/endpoint/windows_proxy_via_registry.yml +++ b/detections/endpoint/windows_proxy_via_registry.yml @@ -1,6 +1,6 @@ name: Windows Proxy Via Registry id: 0270455b-1385-4579-9ac5-e77046c508ae -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,10 @@ description: The following analytic detects the modification of registry keys re the system. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - ="*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*" by Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.action Registry.dest Registry.user + ="*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_proxy_via_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index 9e419ace18..02b297052a 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -1,6 +1,6 @@ name: Windows Raccine Scheduled Task Deletion id: c9f010da-57ab-11ec-82bd-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe - Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`' + Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_raccine_scheduled_task_deletion_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index d32b055b50..76c8696a7b 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -1,6 +1,6 @@ name: Windows Rapid Authentication On Multiple Hosts id: 62606c77-d53d-4182-9371-b02cdbbbcef7 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk type: TTP @@ -16,8 +16,9 @@ description: The following analytic detects a source computer authenticating to sensitive data and escalating privileges within the network. search: '`wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$" | bucket span=5m _time | stats dc(Computer) AS unique_targets - values(Computer) as host_targets by _time, IpAddress, TargetUserName | where unique_targets - > 30 | `windows_rapid_authentication_on_multiple_hosts_filter`' + values(Computer) as host_targets values(dest) as dest values(src) as src values(user) + as user by _time, IpAddress, TargetUserName, action, app, authentication_method, + signature, signature_id | where unique_targets > 30 | `windows_rapid_authentication_on_multiple_hosts_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 8e15a67174..3424051032 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -1,6 +1,6 @@ name: Windows Rasautou DLL Execution id: 6f42b8be-8e96-11ec-ad5a-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe - Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`' + Processes.process="* -d *"AND Processes.process="* -p *" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_rasautou_dll_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index b12079e3c2..e75eecf66f 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -1,6 +1,6 @@ name: Windows Raw Access To Disk Volume Partition id: a85aa37e-9647-11ec-90c5-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,8 +17,9 @@ data_source: - Sysmon EventID 9 search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as - lastTime by dest signature signature_id process_guid process_name process_path Device - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`' + lastTime by dest dvc process_exec process_guid process_id process_name process_path + signature signature_id user_id vendor_product Device Image | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least @@ -69,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index a689fa523f..fe4070e592 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -1,6 +1,6 @@ name: Windows Raw Access To Master Boot Record Drive id: 7b83f666-900c-11ec-a2d9-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,9 @@ data_source: - Sysmon EventID 9 search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as - lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode - | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_raw_access_to_master_boot_record_drive_filter`' + lastTime by dest dvc process_exec process_guid process_id process_name process_path + signature signature_id user_id vendor_product Device Image | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least @@ -72,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_rdp_file_execution.yml b/detections/endpoint/windows_rdp_file_execution.yml index dd590dc0e6..2b6682a1e9 100644 --- a/detections/endpoint/windows_rdp_file_execution.yml +++ b/detections/endpoint/windows_rdp_file_execution.yml @@ -1,6 +1,6 @@ name: Windows RDP File Execution id: 0b6b12b9-8ba9-48fe-b3b8-b4e3e1cd22b4 -version: 2 +version: 3 date: '2025-01-21' author: Michael Haag, Splunk type: TTP @@ -18,8 +18,12 @@ data_source: search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*\\AppData\\Local\\Temp\\*", "*\\Olk\\Attachments\\*", "*\\AppData\\Local\\Microsoft\\Outlook\\*", "*\\Content.Outlook\\*", "*\\Downloads\\*") - AND Processes.process="*.rdp*" by Processes.process Processes.process_name Processes.user - Processes.dest Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` + AND Processes.process="*.rdp*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval execution_type=case( match(process, "\\\\Temp\\\\.*\\.(zip|7z|rar|cab|tgz|gz|tar|iso|img|vhd|vhdx).*\\.*\\.rdp"), "temp_archive_execution", match(process, "\\\\Downloads\\\\"), "downloads_execution", @@ -88,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1598.002/rdp/mstsc_rdpfile-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1598.002/rdp/mstsc_rdpfile-windows-sysmon.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml index f7c784acb7..fd878a408f 100644 --- a/detections/endpoint/windows_registry_bootexecute_modification.yml +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -1,6 +1,6 @@ name: Windows Registry BootExecute Modification id: eabbac3a-45aa-4659-920f-6b8cff383fb8 -version: 7 +version: 8 date: '2024-12-16' author: Michael Haag, Teoderick Contreras, Splunk status: production @@ -17,9 +17,10 @@ description: The following analytic detects modifications to the BootExecute reg arbitrary code at boot, or disrupt system operations. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\System\\CurrentControlSet\\Control\\Session - Manager\\BootExecute" BY Registry.dest Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid, - Registry.action | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) + Manager\\BootExecute" by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_registry_bootexecute_modification_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on Windows Registry that include the name of the path and key responsible for the @@ -67,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index 3356d7adcf..7ebd73e3d9 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -1,6 +1,6 @@ name: Windows Registry Certificate Added id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Teodeerick Contreras, Splunk status: production @@ -17,10 +17,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\certificates\\*") - AND Registry.registry_value_name="Blob" by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data - | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_registry_certificate_added_filter`' + AND Registry.registry_value_name="Blob" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_certificate_added_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml index 52bce6eec2..4a5318042e 100644 --- a/detections/endpoint/windows_registry_delete_task_sd.yml +++ b/detections/endpoint/windows_registry_delete_task_sd.yml @@ -1,6 +1,6 @@ name: Windows Registry Delete Task SD id: ffeb7893-ff06-446f-815b-33ca73224e92 -version: 6 +version: 7 date: '2025-01-21' author: Michael Haag, Teoderick Contreras, Splunk status: production @@ -18,10 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\Schedule\\TaskCache\\Tree\\*") Registry.user="SYSTEM" Registry.registry_value_name="SD" (Registry.action=Deleted - OR Registry.action=modified) by Registry.dest Registry.process_guid Registry.user - Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.registry_value_data - Registry.status Registry.action | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_registry_delete_task_sd_filter`' + OR Registry.action=modified) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_delete_task_sd_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index 5e2ddf9fce..7a12993b89 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -1,6 +1,6 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df -version: 4 +version: 5 date: '2025-02-10' author: Nasreddine Bencherchali, Splunk status: production @@ -19,10 +19,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Environment*" Registry.registry_value_name="COMPlus_ETWEnabled" (Registry.registry_value_data=0x000000000 - OR Registry.registry_value_data=0) BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_dotnet_etw_disabled_via_env_variable_filter`' + OR Registry.registry_value_data=0) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_registry_dotnet_etw_disabled_via_env_variable_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/dotnet_etw_bypass.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/dotnet_etw_bypass.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml index b19bc42c31..fac417f476 100644 --- a/detections/endpoint/windows_registry_entries_exported_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -1,18 +1,42 @@ name: Windows Registry Entries Exported Via Reg id: 466379bc-0f47-476c-8202-16ef38112e0d -version: 1 +version: 2 date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects the execution of the reg.exe process with either the "save" or "export" parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" or "reg export" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry. +description: The following analytic detects the execution of the reg.exe process with + either the "save" or "export" parameters. This detection leverages data from Endpoint + Detection and Response (EDR) agents, focusing on process execution logs and command-line + arguments. This activity is significant because threat actors often use the "reg + save" or "reg export" command to dump credentials or test registry modification + capabilities on compromised hosts. If confirmed malicious, this behavior could allow + attackers to escalate privileges, persist in the environment, or access sensitive + information stored in the registry. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process IN ("* save *", "* export *") by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_exported_via_reg_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process + IN ("* save *", "* export *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_exported_via_reg_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry + before updates or modifying critical registries. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS diff --git a/detections/endpoint/windows_registry_entries_restored_via_reg.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml index ae180959c0..823f030c79 100644 --- a/detections/endpoint/windows_registry_entries_restored_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml @@ -1,18 +1,42 @@ name: Windows Registry Entries Restored Via Reg id: a17af481-e2ad-494c-9da6-afb4d243a019 -version: 1 +version: 2 date: '2025-01-14' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects the execution of reg.exe with the "restore" parameter, indicating an attempt to restore registry backup data on a host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate post-exploitation actions, such as those performed by tools like winpeas, which use "reg save" and "reg restore" to manipulate registry settings. If confirmed malicious, this could allow an attacker to revert registry changes, potentially bypassing security controls and maintaining persistence. +description: The following analytic detects the execution of reg.exe with the "restore" + parameter, indicating an attempt to restore registry backup data on a host. This + detection leverages data from Endpoint Detection and Response (EDR) agents, focusing + on process execution logs and command-line arguments. This activity is significant + as it may indicate post-exploitation actions, such as those performed by tools like + winpeas, which use "reg save" and "reg restore" to manipulate registry settings. + If confirmed malicious, this could allow an attacker to revert registry changes, + potentially bypassing security controls and maintaining persistence. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* restore *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_restored_via_reg_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process + = "* restore *" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_restored_via_reg_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry + before updates or modifying critical registries. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index 62646eee25..589c93ded5 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -1,6 +1,6 @@ name: Windows Registry Modification for Safe Mode Persistence id: c6149154-c9d8-11eb-9da7-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Michael Haag, Splunk status: production @@ -17,9 +17,10 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") - by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_modification_for_safe_mode_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_payload_injection.yml b/detections/endpoint/windows_registry_payload_injection.yml index e798fc114f..092ce66f27 100644 --- a/detections/endpoint/windows_registry_payload_injection.yml +++ b/detections/endpoint/windows_registry_payload_injection.yml @@ -1,6 +1,6 @@ name: Windows Registry Payload Injection id: c6b2d80f-179a-41a1-b95e-ce5601d7427a -version: 5 +version: 6 date: '2025-02-10' author: Steven Dick status: production @@ -14,21 +14,14 @@ description: The following analytic detects suspiciously long data written to th to maintain persistence, execute code, or manipulate system configurations without leaving a conventional file footprint. data_source: -- Sysmon EventID 1 AND Sysmon EventID 12 -- Sysmon EventID 1 AND Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid| `drop_dm_object_name(Processes)` - | join max=0 dest process_guid [| tstats `security_content_summariesonly` count - from datamodel=Endpoint.Registry where Registry.registry_value_data=* by _time span=1h - Registry.dest Registry.registry_path Registry.registry_value_name Registry.process_guid - Registry.registry_value_data Registry.registry_key_name | `drop_dm_object_name(Registry)` - | eval reg_data_len = len(registry_value_data) | where reg_data_len > 512] | fields - firstTime lastTime dest user parent_process_name parent_process process_name process_path - process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data)| `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `windows_registry_payload_injection_filter`' +- Sysmon EventID 12 +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_value_data=* by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_payload_injection_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -58,8 +51,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The process $process_name$ added a suspicious length of registry data on - $dest$. + message: A process added a suspicious length of registry data on $dest$. risk_objects: - field: dest type: system @@ -67,11 +59,7 @@ rba: - field: user type: user score: 60 - threat_objects: - - field: process_name - type: process_name - - field: process_name - type: process_name + threat_objects: [] tags: analytic_story: - Unusual Processes @@ -86,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_sip_provider_modification.yml b/detections/endpoint/windows_registry_sip_provider_modification.yml index 2a0f284cae..2215edb719 100644 --- a/detections/endpoint/windows_registry_sip_provider_modification.yml +++ b/detections/endpoint/windows_registry_sip_provider_modification.yml @@ -1,6 +1,6 @@ name: Windows Registry SIP Provider Modification id: 3b4e18cb-497f-4073-85ad-1ada7c2107ab -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -20,9 +20,12 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path IN ("*\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\*", "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType*") - Registry.registry_value_name IN ("Dll","$DLL") by Registry.dest , Registry.user - Registry.registry_value_name, Registry.registry_value_data | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`| `windows_registry_sip_provider_modification_filter`' + Registry.registry_value_name IN ("Dll","$DLL") by Registry.action Registry.dest + Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`| + `windows_registry_sip_provider_modification_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.003/sip/sip_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.003/sip/sip_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/endpoint/windows_regsvr32_renamed_binary.yml index 53b64d87dd..d3467ad576 100644 --- a/detections/endpoint/windows_regsvr32_renamed_binary.yml +++ b/detections/endpoint/windows_regsvr32_renamed_binary.yml @@ -1,6 +1,6 @@ name: Windows Regsvr32 Renamed Binary id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != regsvr32.exe - AND Processes.original_file_name=regsvr32.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_regsvr32_renamed_binary_filter`' + AND Processes.original_file_name=regsvr32.exe by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_regsvr32_renamed_binary_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -70,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_3/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_3/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml index 4c4fa2c437..1e236b2f62 100644 --- a/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml +++ b/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml @@ -1,6 +1,6 @@ name: Windows Remote Access Software BRC4 Loaded Dll id: 73cf5dcb-cf36-4167-8bbe-384fe5384d05 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,13 +15,20 @@ description: The following analytic identifies the loading of four specific Wind of the affected system. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 |bin _time span=30s | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", +search: '`sysmon` EventCode=7 | bin _time span=30s | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0) | eval BRC4_LoadedDllPath=case(match(ImageLoaded, "credui.dll"), 1, match(ImageLoaded, "dbghelp.dll"), 1, match(ImageLoaded, "samcli.dll"), 1, match(ImageLoaded, "winhttp.dll"), 1, 1=1, 0) | stats count min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as ImageLoaded values(OriginalFileName) as OriginalFileName dc(ImageLoaded) as ImageLoadedCount - by Image BRC4_LoadedDllPath BRC4_AnomalyLoadedDll dest EventCode Signed | where ImageLoadedCount + values(loaded_file) as loaded_file values(loaded_file_path) as loaded_file_path + values(original_file_name) as original_file_name values(process_exec) as process_exec + values(process_guid) as process_guid values(process_hash) as process_hash values(process_id) + as process_id values(process_name) as process_name values(process_path) as process_path + values(service_dll_signature_exists) as service_dll_signature_exists values(service_dll_signature_verified) + as service_dll_signature_verified values(signature) as signature values(signature_id) + as signature_id values(user_id) as user_id values(vendor_product) as vendor_product + by Image BRC4_LoadedDllPath BRC4_AnomalyLoadedDll dest Signed | where ImageLoadedCount == 4 AND (BRC4_LoadedDllPath == 1 OR BRC4_AnomalyLoadedDll == 1) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_brc4_loaded_dll_filter`' how_to_implement: The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 @@ -74,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_access_software_hunt.yml b/detections/endpoint/windows_remote_access_software_hunt.yml index bc3712b667..a7867b9b36 100644 --- a/detections/endpoint/windows_remote_access_software_hunt.yml +++ b/detections/endpoint/windows_remote_access_software_hunt.yml @@ -1,6 +1,6 @@ name: Windows Remote Access Software Hunt id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -20,10 +20,15 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown - Processes.user!=unknown by Processes.dest Processes.user Processes.process_name - Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | lookup remote_access_software remote_utility - AS process_name OUTPUT isutility | search isutility = True | `windows_remote_access_software_hunt_filter`' + Processes.user!=unknown by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup + remote_access_software remote_utility AS process_name OUTPUT isutility | search + isutility = True | `windows_remote_access_software_hunt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -55,7 +60,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_access_software_rms_registry.yml b/detections/endpoint/windows_remote_access_software_rms_registry.yml index a350c2e7f5..d9f3500a0e 100644 --- a/detections/endpoint/windows_remote_access_software_rms_registry.yml +++ b/detections/endpoint/windows_remote_access_software_rms_registry.yml @@ -1,6 +1,6 @@ name: Windows Remote Access Software RMS Registry id: e5b7b5a9-e471-4be8-8c5d-4083983ba329 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote - Manipulator System*" by Registry.registry_key_name Registry.user Registry.registry_path - Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`' + Manipulator System*" by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index e6810e6c34..857d331384 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -1,6 +1,6 @@ name: Windows Remote Assistance Spawning Process id: ced50492-8849-11ec-9f68-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe - `windows_shells` by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`' + `windows_shells` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -78,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/msra/msra-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index ffa6ead077..36d6a9e737 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -1,6 +1,6 @@ name: Windows Remote Create Service id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9 -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,14 @@ description: The following analytic identifies the creation of a new service on code on the remote system, potentially leading to further compromise of the network. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe - Processes.process IN ("*create*") Processes.process="*\\\\*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_create_service_filter`' + Processes.process IN ("*create*") Processes.process="*\\\\*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_remote_create_service_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_management_execute_shell.yml b/detections/endpoint/windows_remote_management_execute_shell.yml index 822b375a99..dc6c3e148e 100644 --- a/detections/endpoint/windows_remote_management_execute_shell.yml +++ b/detections/endpoint/windows_remote_management_execute_shell.yml @@ -1,6 +1,6 @@ name: Windows Remote Management Execute Shell id: 28b80028-851d-4b8d-88a5-375ba115418a -version: 1 +version: 2 date: '2024-12-12' author: Teoderick Contreras, Splunk data_source: @@ -8,16 +8,35 @@ data_source: - Windows Event Log Security 4688 type: Anomaly status: production -description: The following analytic detects the execution of winrshost.exe initiating CMD or PowerShell processes as part of a potential payload execution. winrshost.exe is associated with Windows Remote Management (WinRM) and is typically used for remote execution. By monitoring for this behavior, the detection identifies instances where winrshost.exe is leveraged to run potentially malicious commands or payloads via CMD or PowerShell. This behavior may indicate exploitation of remote management tools for unauthorized access or lateral movement within a compromised environment, signaling a potential security incident. -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name="winrshost.exe" AND Processes.process_name IN ("cmd.exe","*powershell*") - by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic detects the execution of winrshost.exe initiating + CMD or PowerShell processes as part of a potential payload execution. winrshost.exe + is associated with Windows Remote Management (WinRM) and is typically used for remote + execution. By monitoring for this behavior, the detection identifies instances where + winrshost.exe is leveraged to run potentially malicious commands or payloads via + CMD or PowerShell. This behavior may indicate exploitation of remote management + tools for unauthorized access or lateral movement within a compromised environment, + signaling a potential security incident. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winrshost.exe" + AND Processes.process_name IN ("cmd.exe","*powershell*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_management_execute_shell_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: administrator or power user can execute command shell or script remotely using WINRM. +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: administrator or power user can execute command shell or script + remotely using WINRM. references: - https://strontic.github.io/xcyclopedia/library/winrshost.exe-6790044CEB4BA5BE6AA8161460D990FD.html drilldown_searches: @@ -26,11 +45,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a winrm remote proces [$parent_process_name$] execute [$process_name$] shell on [$dest$]. + message: a winrm remote proces [$parent_process_name$] execute [$process_name$] + shell on [$dest$]. risk_objects: - field: dest type: system diff --git a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml index 780c0b7854..bd26f500e7 100644 --- a/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml +++ b/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml @@ -1,6 +1,6 @@ name: Windows Remote Service Rdpwinst Tool Execution id: c8127f87-c7c9-4036-89ed-8fe4b30e678c -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") - AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`' + AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_remote_service_rdpwinst_tool_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml index 52c5aed5a0..d4f8abb91e 100644 --- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml +++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml @@ -1,6 +1,6 @@ name: Windows Remote Services Allow Rdp In Firewall id: 9170cb54-ea15-41e1-9dfc-9f3363ce9b02 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -23,8 +23,12 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process - = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + = "*action=allow*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml index 73477c2bab..eadd104d3a 100644 --- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml +++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml @@ -1,6 +1,6 @@ name: Windows Remote Services Allow Remote Assistance id: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal - Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_remote_services_allow_remote_assistance_filter`' + Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_remote_services_allow_remote_assistance_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_services_rdp_enable.yml b/detections/endpoint/windows_remote_services_rdp_enable.yml index cff2b606f3..4b26c34e1b 100644 --- a/detections/endpoint/windows_remote_services_rdp_enable.yml +++ b/detections/endpoint/windows_remote_services_rdp_enable.yml @@ -1,6 +1,6 @@ name: Windows Remote Services Rdp Enable id: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,10 +17,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal - Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.action - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_remote_services_rdp_enable_filter`' + Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_remote_services_rdp_enable_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 3d1e836554..0bede66e7c 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,7 +1,7 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 -version: '8' -date: '2025-02-24' +version: 9 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -19,9 +19,11 @@ search: '|tstats `security_content_summariesonly` count min(_time) as firstTime OR Filesystem.file_name = *.dll OR Filesystem.file_name = *.sys OR Filesystem.file_name = *.com OR Filesystem.file_name = *.vbs OR Filesystem.file_name = *.vbe OR Filesystem.file_name = *.js OR Filesystem.file_name= *.bat OR Filesystem.file_name = *.cmd OR Filesystem.file_name - = *.pif) by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.user Filesystem.dest | `drop_dm_object_name(Filesystem)` - | eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count + = *.pif) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + eval dropped_file_path = split(file_path, "\\") | eval dropped_file_path_split_count = mvcount(dropped_file_path) | eval root_drive = mvindex(dropped_file_path,0) | where LIKE(root_drive, "%:") AND dropped_file_path_split_count = 2 AND root_drive!= "C:" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index b4b40d775a..897a9f0df7 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -1,6 +1,6 @@ name: Windows Root Domain linked policies Discovery id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -15,10 +15,10 @@ description: The following analytic detects the use of the `[Adsisearcher]` type data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText - = "*.SearchRooT*" ScriptBlockText = "*.gplink*" | stats count min(_time) as firstTime - max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | rename Computer - as dest, user_id as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_root_domain_linked_policies_discovery_filter`' + = "*.SearchRooT*" ScriptBlockText = "*.gplink*" | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product + EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_root_domain_linked_policies_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -64,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml b/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml index f1c867ecd3..0ea69a1e87 100644 --- a/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml +++ b/detections/endpoint/windows_rundll32_apply_user_settings_changes.yml @@ -1,6 +1,6 @@ name: Windows Rundll32 Apply User Settings Changes id: b9fb8d97-dbc9-4a09-804c-ff0e3862bb2d -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,13 @@ description: The following analytic detects the execution of a suspicious rundll potentially leading to persistent unauthorized access. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process= "*user32.dll,UpdatePerUserSystemParameters*" by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.parent_process_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Processes.process= "*user32.dll,UpdatePerUserSystemParameters*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_apply_user_settings_changes_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/update_per_user_system/rundll32_updateperusersystem.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/update_per_user_system/rundll32_updateperusersystem.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_rundll32_webdav_request.yml b/detections/endpoint/windows_rundll32_webdav_request.yml index 68ccb04ab4..20aae0c3d0 100644 --- a/detections/endpoint/windows_rundll32_webdav_request.yml +++ b/detections/endpoint/windows_rundll32_webdav_request.yml @@ -1,6 +1,6 @@ name: Windows Rundll32 WebDAV Request id: 320099b7-7eb1-4153-a2b4-decb53267de2 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk type: TTP @@ -19,9 +19,13 @@ description: The following analytic identifies the execution of rundll32.exe wit search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process IN ("*\\windows\\system32\\davclnt.dll,*davsetcookie*","*\\windows\\syswow64\\davclnt.dll,*davsetcookie*") - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rundll32_webdav_request_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_rundll32_webdav_request_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 9758e6d09f..f71133e44c 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -1,10 +1,10 @@ name: Windows RunMRU Command Execution id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a -version: 3 +version: 4 date: '2025-02-17' author: Nasreddine Bencherchali, Michael Haag, Splunk data_source: -- Sysmon EventID 11 +- Sysmon EventID 12 - Sysmon EventID 13 type: Anomaly status: production @@ -18,10 +18,11 @@ description: The following analytic detects modifications to the Windows RunMRU changes to focus on actual command entries. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" - NOT Registry.registry_key_name="*\\MRUList" by Registry.dest Registry.registry_value_data - Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name - Registry.user | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' + NOT Registry.registry_key_name="*\\MRUList" by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon_runmru.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon_runmru.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scheduled_task_created_via_xml.yml b/detections/endpoint/windows_scheduled_task_created_via_xml.yml index 0a239e80fc..bd0e0060ff 100644 --- a/detections/endpoint/windows_scheduled_task_created_via_xml.yml +++ b/detections/endpoint/windows_scheduled_task_created_via_xml.yml @@ -1,6 +1,6 @@ name: Windows Scheduled Task Created Via XML id: 7e03b682-3965-4598-8e91-a60a40a3f7e4 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ description: The following analytic detects the creation of scheduled tasks in W or ransomware deployment. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe - Processes.process=*create* Processes.process="* /xml *" by Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_guid - Processes.process_id Processes.parent_process_guid Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_created_via_xml_filter`' + Processes.process=*create* Processes.process="* /xml *" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_scheduled_task_created_via_xml_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/scheduledtask/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml b/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml index 21d9851f03..248aa193a6 100644 --- a/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml +++ b/detections/endpoint/windows_scheduled_task_dll_module_loaded.yml @@ -1,6 +1,6 @@ name: Windows Scheduled Task DLL Module Loaded id: bc5b2304-f241-419b-874a-e927f667b7b6 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: @@ -19,8 +19,10 @@ search: '`sysmon` EventCode=7 Image IN ("*\\windows\\fonts\\*", "*\\windows\\tem "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\temp\\*", "*\\PerfLogs\\*") ImageLoaded = "*\\taskschd.dll" - | stats min(_time) as firstTime max(_time) as lastTime count by user_id, dest, Image - ,ImageLoaded, , OriginalFileName, ProcessGuid | `security_content_ctime(firstTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Image + ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid + process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_dll_module_loaded_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/taskschd_dll/taskschd_dll.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/taskschd_dll/taskschd_dll.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 32d51b68be..fcc756b03f 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -1,6 +1,6 @@ name: Windows Scheduled Task Service Spawned Shell id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 -version: 5 +version: 6 date: '2025-02-19' author: Steven Dick status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime AND Processes.parent_process="*-k*" AND Processes.parent_process= "*netsvcs*" AND Processes.parent_process="*-p*" AND Processes.parent_process="*-s*" AND Processes.parent_process="*Schedule*" Processes.process_name IN("powershell.exe", "wscript.exe", "cscript.exe", "cmd.exe", - "sh.exe", "ksh.exe", "zsh.exe", "bash.exe", "scrcons.exe","pwsh.exe") by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id Processes.parent_process_name | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + "sh.exe", "ksh.exe", "zsh.exe", "bash.exe", "scrcons.exe","pwsh.exe") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scheduled_task_service_spawned_shell_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml index 0cb70faff7..2ea3c9f444 100644 --- a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml +++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml @@ -1,6 +1,6 @@ name: Windows Scheduled Task with Highest Privileges id: 2f15e1a4-0fc2-49dd-919e-cbbe60699218 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "schtasks.exe" - Processes.process = "*/rl *" Processes.process = "* highest *" by Processes.process_name - Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_scheduled_task_with_highest_privileges_filter`' + Processes.process = "*/rl *" Processes.process = "* highest *" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_scheduled_task_with_highest_privileges_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index bb349b102f..e99ab085e9 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -1,6 +1,6 @@ name: Windows Schtasks Create Run As System id: 41a0e58e-884c-11ec-9976-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create - *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`' + *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_schtasks_create_run_as_system_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml index ed40b78862..4868593dea 100644 --- a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml +++ b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml @@ -1,6 +1,6 @@ name: Windows ScManager Security Descriptor Tampering Via Sc.EXE id: 04023928-0381-4935-82cb-03372b2ef644 -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production @@ -17,9 +17,12 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) Processes.process="*sdset - *" Processes.process="*scmanager*" by Processes.dest Processes.user Processes.parent_process - Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + *" Processes.process="*scmanager*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_scmanager_security_descriptor_tampering_via_sc_exe_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -51,8 +54,9 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. risk_objects: - field: user type: user @@ -77,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/scmanager_sddl_tamper_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/scmanager_sddl_tamper_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml index 47f322e003..98f6cad25b 100644 --- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml +++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml @@ -1,6 +1,6 @@ name: Windows Screen Capture in TEMP folder id: 00524d1f-a032-46f5-9108-e7d9f01bfb3c -version: 3 +version: 4 date: '2025-02-17' author: Teoderick Contreras, Splunk data_source: @@ -17,10 +17,12 @@ description: The following analytic detects the creation of screen capture files data is compromised. search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("screenshot.png", - "screenshot.jpg","screenshot.bmp") Filesystem.file_path = "*\\temp\\*" by _time - Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.file_create_time - | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_screen_capture_in_temp_folder_filter`' + "screenshot.jpg","screenshot.bmp") Filesystem.file_path = "*\\temp\\*" by Filesystem.action + Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash + Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user + Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_screen_capture_in_temp_folder_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1113/braodo_screenshot/braodo_screenshot.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1113/braodo_screenshot/braodo_screenshot.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml index b42642a01b..c3721610d7 100644 --- a/detections/endpoint/windows_screen_capture_via_powershell.yml +++ b/detections/endpoint/windows_screen_capture_via_powershell.yml @@ -1,6 +1,6 @@ name: Windows Screen Capture Via Powershell id: 5e0b1936-8f99-4399-8ee2-9edc5b32e170 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects the execution of a PowerShell script leading to data breaches or further exploitation. search: '`powershell` EventCode=4104 ScriptBlockText = "*[Drawing.Graphics]::FromImage(*" AND ScriptBlockText = "*New-Object Drawing.Bitmap*" AND ScriptBlockText = "*.CopyFromScreen*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText - Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest + signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_screen_capture_via_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -42,9 +43,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: A PowerShell script was identified possibly performing screen captures - on $Computer$. + on $dest$. risk_objects: - - field: Computer + - field: dest type: system score: 49 threat_objects: [] @@ -62,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index cba26b4c94..a9ef035370 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -1,6 +1,6 @@ name: Windows Security Account Manager Stopped id: 69c12d59-d951-431e-ab77-ec426b8d65e6 -version: 6 +version: 7 date: '2024-12-10' author: Rod Soto, Jose Hernandez, Splunk status: production @@ -19,8 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" - "Processes.process"="*stop \"samss\"*") BY Processes.dest Processes.user Processes.process - Processes.process_guid Processes.process_name | `drop_dm_object_name(Processes)` + "Processes.process"="*stop \"samss\"*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_security_account_manager_stopped_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_security_support_provider_reg_query.yml b/detections/endpoint/windows_security_support_provider_reg_query.yml index 78ab163dc2..0f0fb69923 100644 --- a/detections/endpoint/windows_security_support_provider_reg_query.yml +++ b/detections/endpoint/windows_security_support_provider_reg_query.yml @@ -1,6 +1,6 @@ name: Windows Security Support Provider Reg Query id: 31302468-93c9-4eca-9ae3-2d41f53a4e2b -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -21,11 +21,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* query *" AND Processes.process = "*\\SYSTEM\\CurrentControlSet\\Control\\LSA*" - Processes.process IN ("*RunAsPPL*" , "*LsaCfgFlags*") by Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.process_guid - Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_security_support_provider_reg_query_filter`' + Processes.process IN ("*RunAsPPL*" , "*LsaCfgFlags*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_security_support_provider_reg_query_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 57b7d6e524..52141dd191 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -1,6 +1,6 @@ name: Windows Sensitive Group Discovery With Net id: d9eb7cda-5622-4722-bc88-7f2442f4b5af -version: 2 +version: 3 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*", - "*Domain Computers*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_sensitive_group_discovery_with_net_filter`' + "*Domain Computers*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_group_discovery_with_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 2bcf7f806f..402c3dfe51 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process - IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.parent_process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' + IN ("*SAM*", "*System*", "*Security*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -90,7 +93,6 @@ tags: tests: - name: True Positive Test - Sysmon attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml index f0baa10770..c78d373060 100644 --- a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml +++ b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml @@ -1,6 +1,6 @@ name: Windows Server Software Component GACUtil Install to GAC id: 7c025ef0-9e65-4c57-be39-1c13dbb1613e -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -18,10 +18,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=gacutil.exe - Processes.process IN ("*-i *","*/i *") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_server_software_component_gacutil_install_to_gac_filter`' + Processes.process IN ("*-i *","*/i *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_server_software_component_gacutil_install_to_gac_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/gacutil_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.004/gacutil_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_create_kernel_mode_driver.yml b/detections/endpoint/windows_service_create_kernel_mode_driver.yml index b9a59dae84..3bd536a3c1 100644 --- a/detections/endpoint/windows_service_create_kernel_mode_driver.yml +++ b/detections/endpoint/windows_service_create_kernel_mode_driver.yml @@ -1,6 +1,6 @@ name: Windows Service Create Kernel Mode Driver id: 0b4e3b06-1b2b-4885-b752-cf06d12a90cb -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe - Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_service_create_kernel_mode_driver_filter`' + Processes.process="*kernel*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_create_kernel_mode_driver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sc_kernel.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sc_kernel.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index 747300e74b..360ab8bb3b 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -1,6 +1,6 @@ name: Windows Service Create with Tscon id: c13b3d74-6b63-4db5-a841-4206f0370077 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk type: TTP @@ -19,10 +19,13 @@ description: The following analytic detects potential RDP Hijacking attempts by or further system compromise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe - Processes.process="*/dest:rdp-tcp*" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_service_create_with_tscon_filter`' + Processes.process="*/dest:rdp-tcp*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_create_with_tscon_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -91,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index 1a143a424a..d8ef56b549 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -1,7 +1,7 @@ name: Windows Service Creation on Remote Endpoint id: e0eea4fa-4274-11ec-882b-3e22fbd008af -version: '7' -date: '2025-02-13' +version: 8 +date: '2025-03-27' author: Mauricio Velazco, Splunk status: production type: TTP @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create* - AND Processes.process=*binpath*) by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `windows_service_creation_on_remote_endpoint_filter`' + AND Processes.process=*binpath*) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index e3acea777d..2c15c4949d 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: '13' -date: '2025-02-26' +version: 14 +date: '2025-03-27' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -16,10 +16,12 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" - Registry.registry_value_name = ImagePath) BY Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`' + Registry.registry_value_name = ImagePath) by Registry.action Registry.dest Registry.process_guid + Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_service_creation_using_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index 7303c7321a..20d54693e8 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -1,6 +1,6 @@ name: Windows Service Deletion In Registry id: daed6823-b51c-4843-a6ad-169708f1323e -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND - Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) by Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name - Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_deletion_in_registry_filter`' + Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_service_deletion_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index 43198428c0..7ab8fc5706 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -1,6 +1,6 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 -version: 3 +version: 4 date: '2025-01-07' author: Michael Haag, Splunk type: TTP @@ -19,10 +19,13 @@ description: The following analytic identifies the execution of RemCom.exe, an o search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=remcom.exe OR Processes.original_file_name=RemCom.exe) Processes.process="*\\*" Processes.process - IN ("*/user:*", "*/pwd:*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_execution_remcom_filter`' + IN ("*/user:*", "*/pwd:*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_execution_remcom_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -52,7 +55,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to move laterally. risk_objects: - field: user type: user @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/remcom/remcom_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/remcom/remcom_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index 0c2963cf1d..310fc2fbfb 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -1,6 +1,6 @@ name: Windows Service Initiation on Remote Endpoint id: 3f519894-4276-11ec-ab02-3e22fbd008af -version: 6 +version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -19,9 +19,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*) - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `windows_service_initiation_on_remote_endpoint_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml index 86253b0dc4..c4d746770f 100644 --- a/detections/endpoint/windows_service_stop_attempt.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -1,18 +1,42 @@ name: Windows Service Stop Attempt id: dd0f07ea-f08f-4d88-96e5-cb58156e82b6 -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic identifies attempts to stop services on a system using `net.exe`, `sc.exe` or the "Stop-Service" cmdlet. It leverages Endpoint Detection and Response (EDR) telemetry. This activity can be significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise. +description: The following analytic identifies attempts to stop services on a system + using `net.exe`, `sc.exe` or the "Stop-Service" cmdlet. It leverages Endpoint Detection + and Response (EDR) telemetry. This activity can be significant as adversaries often + terminate security or critical services to evade detection and further their objectives. + If confirmed malicious, this behavior could allow attackers to disable security + defenses, facilitate ransomware encryption, or disrupt essential services, leading + to potential data loss or system compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_attempt_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Windows OS or software may stop and restart services due to some critical update. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) + Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Windows OS or software may stop and restart services due to + some critical update. references: - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ drilldown_searches: @@ -44,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index fc838572a7..405504e52b 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -1,6 +1,6 @@ name: Windows Service Stop By Deletion id: 196ff536-58d9-4d1b-9686-b176b04e430b -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) - Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`' + Processes.process="* delete *" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml index 9224034cad..c3c49353a0 100644 --- a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -1,18 +1,18 @@ name: Windows Set Account Password Policy To Unlimited Via Net id: 11f93009-8083-43fd-82a7-821fcbdc8342 -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Anomaly description: The following analytic detects the use of net.exe to update user account policies to set passwords as non-expiring. It leverages data from Endpoint Detection - and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" or "/maxpwage:49710", which achieve a similar outcome theoretically. - This activity is significant as it can indicate an attempt to maintain persistence, - escalate privileges, evade defenses, or facilitate lateral movement. If confirmed - malicious, this behavior could allow an attacker to maintain long-term access to - compromised accounts, potentially leading to further exploitation and unauthorized - access to sensitive information. + and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" + or "/maxpwage:49710", which achieve a similar outcome theoretically. This activity + is significant as it can indicate an attempt to maintain persistence, escalate privileges, + evade defenses, or facilitate lateral movement. If confirmed malicious, this behavior + could allow an attacker to maintain long-term access to compromised accounts, potentially + leading to further exploitation and unauthorized access to sensitive information. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 @@ -20,7 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="* accounts *" AND (Processes.process="* - /maxpwage:unlimited" OR Processes.process="/maxpwage:49710") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter`' + /maxpwage:unlimited" OR Processes.process="/maxpwage:49710") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_set_account_password_policy_to_unlimited_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 7c955dcf60..365d86bb69 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -1,6 +1,6 @@ name: Windows Snake Malware File Modification Crmlog id: 27187e0e-c221-471d-a7bd-04f698985ff6 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,9 +17,11 @@ description: The following analytic identifies the creation of a .crmlog file wi required to mitigate the threat. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\registration\\*" - AND Filesystem.file_name="*.crmlog" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `windows_snake_malware_file_modification_crmlog_filter`' + AND Filesystem.file_name="*.crmlog" by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_snake_malware_file_modification_crmlog_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_crmlog-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_crmlog-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index d294b72c80..01f68d85f7 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -1,6 +1,6 @@ name: Windows Snake Malware Kernel Driver Comadmin id: 628d9c7c-3242-43b5-9620-7234c080a726 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,9 +17,11 @@ description: The following analytic detects the creation of the comadmin.dat fil escalation and persistent access to the compromised system. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\windows\\system32\\com\\*" - AND Filesystem.file_name="comadmin.dat" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_snake_malware_kernel_driver_comadmin_filter`' + AND Filesystem.file_name="comadmin.dat" by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snake_malware_kernel_driver_comadmin_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/comadmin_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/comadmin_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index 3330397d50..6845aae0ae 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -1,6 +1,6 @@ name: Windows Snake Malware Registry Modification wav OpenWithProgIds id: 13cf8b79-805d-443c-bf52-f55bd7610dfd -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -17,8 +17,10 @@ description: The following analytic identifies modifications to the registry pat system compromise and persistent access. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by - Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_snake_malware_registry_modification_wav_openwithprogids_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_snappybee_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml index 2854203d3f..7399927deb 100644 --- a/detections/endpoint/windows_snappybee_create_test_registry.yml +++ b/detections/endpoint/windows_snappybee_create_test_registry.yml @@ -1,25 +1,34 @@ name: Windows SnappyBee Create Test Registry id: 80402396-d78a-4c6e-ade5-7697ea670adf -version: 1 -date: '2025-02-11' +version: 2 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration file, or system mark compromised. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior. +description: The following analytic detects modifications to the Windows registry + under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications + in a production environment. Monitoring this key is crucial, as adversaries may + create or alter values here for monitoring update of itself file path, updated configuration + file, or system mark compromised. The detection leverages **Sysmon Event ID 13** + (Registry Value Set) to identify unauthorized changes. Analysts should investigate + processes associated with these modifications, particularly unsigned executables + or suspicious command-line activity, as they may indicate malware or unauthorized + software behavior. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" - BY Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.dest Registry.user - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" + by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_snappybee_create_test_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: Administrators and third party software may create this registry entry. +known_false_positives: Administrators and third party software may create this registry + entry. references: - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html drilldown_searches: diff --git a/detections/endpoint/windows_soaphound_binary_execution.yml b/detections/endpoint/windows_soaphound_binary_execution.yml index 0629cd8492..26ef4227aa 100644 --- a/detections/endpoint/windows_soaphound_binary_execution.yml +++ b/detections/endpoint/windows_soaphound_binary_execution.yml @@ -1,6 +1,6 @@ name: Windows SOAPHound Binary Execution id: 8e53f839-e127-4d6d-a54d-a2f67044a57f -version: 7 +version: 8 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -21,12 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name="soaphound.exe" OR Processes.original_file_name="soaphound.exe" AND Processes.process IN ("*--buildcache *", "*--bhdump *", "*--certdump *", "*--dnsdump *", "*-c *", "*--cachefilename *", - "*-o *", "*--outputdirectory *") by Processes.process Processes.dest Processes.process_current_directory - Processes.process_name Processes.process_path Processes.process_integrity_level - Processes.parent_process Processes.parent_process_path Processes.parent_process_guid - Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `windows_soaphound_binary_execution_filter`' + "*-o *", "*--outputdirectory *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_soaphound_binary_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml index 52b946ec39..b75eb83d19 100644 --- a/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml +++ b/detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml @@ -1,6 +1,6 @@ name: Windows Spearphishing Attachment Onenote Spawn Mshta id: 35aeb0e7-7de5-444a-ac45-24d6788796ec -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("onenote.exe", "onenotem.exe") `process_mshta` by Processes.dest Processes.user - Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`' + IN ("onenote.exe", "onenotem.exe") `process_mshta` by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_spearphishing_attachment_onenote_spawn_mshta_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -76,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml index b1b871ae36..82d66591a4 100644 --- a/detections/endpoint/windows_sql_spawning_certutil.yml +++ b/detections/endpoint/windows_sql_spawning_certutil.yml @@ -1,7 +1,7 @@ name: Windows SQL Spawning CertUtil id: dfc18a5a-946e-44ee-a373-c0f60d06e676 -version: 8 -date: '2025-02-26' +version: 9 +date: '2025-03-27' author: Michael Haag, Splunk status: experimental type: TTP @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("sqlservr.exe", "sqlagent.exe", "sqlps.exe", "launchpad.exe", "sqldumper.exe") `process_certutil` (Processes.process="*urlcache*" OR Processes.process="*verifyctl*") - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.original_file_name - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_sql_spawning_certutil_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_sql_spawning_certutil_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_sqlservr_spawning_shell.yml b/detections/endpoint/windows_sqlservr_spawning_shell.yml index 6810ebc521..21724c77cf 100644 --- a/detections/endpoint/windows_sqlservr_spawning_shell.yml +++ b/detections/endpoint/windows_sqlservr_spawning_shell.yml @@ -1,23 +1,34 @@ name: Windows Sqlservr Spawning Shell id: d33aac9f-030c-4830-8701-0c2dd75bb6cb -version: 1 -date: '2025-02-04' +version: 2 +date: '2025-03-27' author: Michael Haag, Splunk status: production type: TTP -description: This analytic detects instances where the sqlservr.exe process spawns a command shell (cmd.exe) or PowerShell process. This behavior is often indicative of command execution initiated from within the SQL Server process, potentially due to exploitation of SQL injection vulnerabilities or the use of extended stored procedures like xp_cmdshell. +description: This analytic detects instances where the sqlservr.exe process spawns + a command shell (cmd.exe) or PowerShell process. This behavior is often indicative + of command execution initiated from within the SQL Server process, potentially due + to exploitation of SQL injection vulnerabilities or the use of extended stored procedures + like xp_cmdshell. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="sqlservr.exe" - `process_cmd` OR `process_powershell` - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.original_file_name - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_sqlservr_spawning_shell_filter`' -how_to_implement: To implement this detection, you need to be ingesting endpoint data that captures process creation events, specifically the parent-child process relationships. Ensure that you are collecting Sysmon Event ID 1 or Windows Event Log Security 4688 events. The data should be mapped to the Endpoint data model in Splunk. -known_false_positives: Legitimate administrative activities or monitoring tools might occasionally spawn command shells from sqlservr.exe. Review the process command-line arguments and consider filtering out known legitimate processes or users. + `process_cmd` OR `process_powershell` by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sqlservr_spawning_shell_filter`' +how_to_implement: To implement this detection, you need to be ingesting endpoint data + that captures process creation events, specifically the parent-child process relationships. + Ensure that you are collecting Sysmon Event ID 1 or Windows Event Log Security 4688 + events. The data should be mapped to the Endpoint data model in Splunk. +known_false_positives: Legitimate administrative activities or monitoring tools might + occasionally spawn command shells from sqlservr.exe. Review the process command-line + arguments and consider filtering out known legitimate processes or users. references: - https://attack.mitre.org/techniques/T1505/001/ - https://github.com/MHaggis/notes/tree/master/utilities/SQLSSTT @@ -28,15 +39,16 @@ drilldown_searches: latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) - as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) - as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A command shell was spawned by sqlservr.exe on host $dest$ by user $user$. This may indicate unauthorized command execution. + message: A command shell was spawned by sqlservr.exe on host $dest$ by user $user$. + This may indicate unauthorized command execution. risk_objects: - field: dest type: system diff --git a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml index 120c3b47ad..697fd098ba 100644 --- a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml +++ b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml @@ -1,6 +1,6 @@ name: Windows SqlWriter SQLDumper DLL Sideload id: 2ed89ba9-c6c7-46aa-9f08-a2a1c2955aa3 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Teoderick Contreras, Splunk data_source: @@ -16,9 +16,11 @@ description: The following analytic detects the abuse of SqlWriter and SQLDumper attackers to execute arbitrary code, maintain persistence, and evade detection by blending with legitimate processes. search: '`sysmon` EventCode=7 (Image="*\\SQLDumper.exe" OR Image="*\\SQLWriter.exe") - ImageLoaded="*\\vcruntime140.dll" NOT ImageLoaded="C:\\Windows\\System32\\*" | stats - values(ImageLoaded) count min(_time) as firstTime max(_time) as lastTime by Image,ImageLoaded, - user, Computer, EventCode | rename Computer as dest | `security_content_ctime(firstTime)` + ImageLoaded="*\\vcruntime140.dll" NOT ImageLoaded="C:\\Windows\\System32\\*" | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded + dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash + process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_sqlwriter_sqldumper_dll_sideload_filter`' how_to_implement: The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into @@ -77,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/wineloader/sqlwriter_sqldumper_sideload_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/wineloader/sqlwriter_sqldumper_sideload_windows-sysmon.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_ssh_proxy_command.yml b/detections/endpoint/windows_ssh_proxy_command.yml index 767b86bcdf..4dcf8ec6d2 100644 --- a/detections/endpoint/windows_ssh_proxy_command.yml +++ b/detections/endpoint/windows_ssh_proxy_command.yml @@ -9,7 +9,13 @@ description: This detection identifies potential abuse of SSH ProxyCommand by mo data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\ssh.exe" Processes.parent_process IN ("*ProxyCommand*") Processes.process IN ("*mshta*","*powershell*","*http*","*wscript*","*cscript*") by Processes.dest Processes.parent_process Processes.parent_process_path Processes.parent_process_name Processes.parent_process_guid Processes.process_path Processes.process Processes.original_file_name Processes.parent_process_id Processes.process_guid Processes.process_current_directory Processes.process_id Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_ssh_proxy_command_filter`' +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_path="*\\ssh.exe" Processes.parent_process IN ("*ProxyCommand*") Processes.process IN ("*mshta*","*powershell*","*http*","*wscript*","*cscript*") by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_ssh_proxy_command_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Legitimate use of SSH ProxyCommand with scripting engines may trigger this detection. Filter as needed based on your environment's normal SSH usage patterns and authorized scripting activities. references: diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml index 10ca564046..3577834339 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates - ESC1 Abuse id: cbe761fc-d945-4c8c-a71d-e26d12255d32 -version: 6 +version: 7 date: '2024-11-13' author: Steven Dick status: production @@ -63,9 +63,6 @@ rba: - field: src type: system score: 60 - - field: dest - type: system - score: 60 - field: src_user type: user score: 60 diff --git a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml index 9e7ceb2759..cc0f42516f 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates CertUtil Backup id: bac85b56-0b65-4ce5-aad5-d94880df0967 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process - IN ("*-backupdb *", "*-backup *") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certutil_backup_filter`' + IN ("*-backupdb *", "*-backup *") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_certutil_backup_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index af44db774c..84436c3184 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates Export Certificate id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*export-certificate*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_certificate_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_steal_authentication_certificates_export_certificate_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index 2e01886698..a2d3704c47 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates Export PfxCertificate id: 391329f3-c14b-4b8d-8b37-ac5012637360 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*export-pfxcertificate*" - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates_export_pfxcertificate_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_steal_authentication_certificates_export_pfxcertificate_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml index 5e796c0d8b..a4b3a718e5 100644 --- a/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml +++ b/detections/endpoint/windows_steal_or_forge_kerberos_tickets_klist.yml @@ -1,6 +1,6 @@ name: Windows Steal or Forge Kerberos Tickets Klist id: 09d88404-1e29-46cb-806c-1eedbc85ad5d -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="klist.exe" OR Processes.original_file_name = "klist.exe" Processes.parent_process_name IN ("cmd.exe", - "powershell*") by Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process - Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_or_forge_kerberos_tickets_klist_filter`' + "powershell*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_steal_or_forge_kerberos_tickets_klist_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -52,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_subinacl_execution.yml b/detections/endpoint/windows_subinacl_execution.yml index 98c369178f..641a01b32e 100644 --- a/detections/endpoint/windows_subinacl_execution.yml +++ b/detections/endpoint/windows_subinacl_execution.yml @@ -1,6 +1,6 @@ name: Windows SubInAcl Execution id: 12491419-1a6f-4af4-afc3-4e2052f0610e -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production @@ -21,10 +21,13 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=subinacl.exe OR Processes.original_file_name=SubInAcl.exe) - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_subinacl_execution_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_subinacl_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -54,7 +57,8 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. risk_objects: - field: user type: user @@ -79,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/subinacl/subinacl_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/subinacl/subinacl_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index b418e2f4d2..c84b92d31b 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -1,6 +1,6 @@ name: Windows Suspect Process With Authentication Traffic id: 953322db-128a-4ce9-8e89-56e039e33d98 -version: 6 +version: 7 date: '2025-02-10' author: Steven Dick status: production @@ -18,10 +18,12 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("88","389","636") AND All_Traffic.app IN ("*\\users\\*", - "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") by - All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user,All_Traffic.dest,All_Traffic.dest_ip,All_Traffic.dest_port - | `drop_dm_object_name(All_Traffic)` | rex field=app ".*\\\(?.*)$" - | rename app as process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") + by All_Traffic.action All_Traffic.app All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version + All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product | `drop_dm_object_name(All_Traffic)` | rex field=app + ".*\\\(?.*)$" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspect_process_with_authentication_traffic_filter`' how_to_implement: To implement this analytic, Sysmon should be installed in the environment and generating network events for userland and/or known public writable locations. @@ -76,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml index 00bfe7a17b..237bda3e2d 100644 --- a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml +++ b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml @@ -1,6 +1,6 @@ name: Windows Suspicious Child Process Spawned From WebServer id: 2d4470ef-7158-4b47-b68b-1f7f16382156 -version: 2 +version: 3 date: '2025-02-10' author: Steven Dick status: production @@ -27,7 +27,11 @@ search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, "scrcons.exe","schtasks.exe","sh.exe","systeminfo.exe","tasklist.exe","tracert.exe","ver.exe","vssadmin.exe", "wevtutil.exe","whoami.exe","wmic.exe","wscript.exe","wusa.exe","zsh.exe") AND Processes.parent_process_name IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe","tomcat*.exe")) - by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_process_name,Processes.process,Processes.process_name + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_child_process_spawned_from_webserver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -96,7 +100,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_suspicious_driver_loaded_path.yml b/detections/endpoint/windows_suspicious_driver_loaded_path.yml index 60383739c7..8e7e459157 100644 --- a/detections/endpoint/windows_suspicious_driver_loaded_path.yml +++ b/detections/endpoint/windows_suspicious_driver_loaded_path.yml @@ -1,6 +1,6 @@ name: Windows Suspicious Driver Loaded Path id: 2ca1c4a1-8342-4750-9363-905650e0c933 -version: 1 +version: 2 date: '2025-02-03' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,11 @@ description: The following analytic detects the loading of drivers from suspicio data_source: - Sysmon EventID 6 search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", - "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*","*:\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*")) | stats min(_time) as - firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature - Signed| rename ImageLoaded as file_name | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `windows_suspicious_driver_loaded_path_filter`' + "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*","*:\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows + Defender\\Definition Updates\\*")) | stats min(_time) as firstTime max(_time) + as lastTime count by ImageLoaded dest dvc process_hash process_path signature signature_id + user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_suspicious_driver_loaded_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -43,14 +44,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious driver $file_name$ on $dest$ + message: Suspicious driver $ImageLoaded$ on $dest$ risk_objects: - field: dest type: system score: 60 - threat_objects: - - field: file_name - type: file_name + threat_objects: [] tags: analytic_story: - XMRig @@ -69,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 07df20b513..cc8af90dbc 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 8 -date: '2025-02-28' +version: 9 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -19,12 +19,17 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes - where Processes.process_path IN("*\\windows\\fonts\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND NOT(Processes.process_path IN ("*\\temp\\*")) - by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", + "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*Recycle.bin*", "*\\Windows\\Media\\*","\\Windows\\repair\\*", "*\\PerfLogs\\*", + "*:\\Windows\\Prefetch\\*", "*:\\Windows\\Cursors\\*", "*:\\Windows\\INF\\*") AND + NOT(Processes.process_path IN ("*\\temp\\*")) by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -119,7 +124,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml index 8714046ce3..05d0308842 100644 --- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml +++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml @@ -1,6 +1,6 @@ name: Windows Svchost.exe Parent Process Anomaly id: 1d38e5e9-2ff8-4c47-872c-bf1657cefab5 -version: 1 +version: 2 date: '2025-02-11' author: Teoderick Contreras, Splunk status: production @@ -13,7 +13,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime where Processes.parent_process_name != "services.exe" AND Processes.process_name = "svchost.exe" AND Processes.process != unknown AND Processes.parent_process_path != "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe" AND Processes.parent_process_path != "C:\\Program Files\\Windows Defender\\MsMpEng.exe" - by Processes.parent_process_name Processes.parent_process_path Processes.parent_process Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 54ade9f424..75f8fd4d8d 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -1,6 +1,6 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,9 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process=*-decompile* - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -80,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml index 9fcc8dd10c..ed0c176d2c 100644 --- a/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml +++ b/detections/endpoint/windows_system_discovery_using_ldap_nslookup.yml @@ -1,6 +1,6 @@ name: Windows System Discovery Using ldap Nslookup id: 2418780f-7c3e-4c45-b8b4-996ea850cd49 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "nslookup.exe" OR Processes.original_file_name = "nslookup.exe") AND Processes.process = "*_ldap._tcp.dc._msdcs*" - by Processes.parent_process Processes.parent_process_name Processes.process_name - Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest - Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_system_discovery_using_ldap_nslookup_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` + | `windows_system_discovery_using_ldap_nslookup_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -73,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_discovery_using_qwinsta.yml b/detections/endpoint/windows_system_discovery_using_qwinsta.yml index 0d47721044..869c183ad4 100644 --- a/detections/endpoint/windows_system_discovery_using_qwinsta.yml +++ b/detections/endpoint/windows_system_discovery_using_qwinsta.yml @@ -1,6 +1,6 @@ name: Windows System Discovery Using Qwinsta id: 2e765c1b-144a-49f0-93d0-1df4287cca04 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "qwinsta.exe" - OR Processes.original_file_name = "qwinsta.exe" by Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.process_id Processes.process_guid Processes.process - Processes.user Processes.dest Processes.parent_process_id Processes.original_file_name + OR Processes.original_file_name = "qwinsta.exe" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `windows_system_discovery_using_qwinsta_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -52,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml index 8550359fdd..d5379572b1 100644 --- a/detections/endpoint/windows_system_file_on_disk.yml +++ b/detections/endpoint/windows_system_file_on_disk.yml @@ -1,6 +1,6 @@ name: Windows System File on Disk id: 993ce99d-9cdd-42c7-a2cf-733d5954e5a6 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -16,8 +16,10 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.sys*" - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path Filesystem.file_hash | `drop_dm_object_name(Filesystem)` | + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_system_file_on_disk_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -44,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_logoff_commandline.yml b/detections/endpoint/windows_system_logoff_commandline.yml index 32c5a3eb5a..810814f08f 100644 --- a/detections/endpoint/windows_system_logoff_commandline.yml +++ b/detections/endpoint/windows_system_logoff_commandline.yml @@ -1,6 +1,6 @@ name: Windows System LogOff Commandline id: 74a8133f-93e7-4b71-9bd3-13a66124fd57 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process IN ("* /l*", "* -l*") Processes.process - IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_logoff_commandline_filter`' + IN ("* /t*","* -t*","* /f*","* -f*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_logoff_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/reboot_logoff_commandline/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/reboot_logoff_commandline/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml index f81dd661ac..224f46db3d 100644 --- a/detections/endpoint/windows_system_network_config_discovery_display_dns.yml +++ b/detections/endpoint/windows_system_network_config_discovery_display_dns.yml @@ -1,6 +1,6 @@ name: Windows System Network Config Discovery Display DNS id: e24f0a0e-41a9-419f-9999-eacab15efc36 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="ipconfig.exe" OR Processes.original_file_name = "ipconfig.exe" AND Processes.process = "*/displaydns*" - by Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_network_config_discovery_display_dns_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_system_network_config_discovery_display_dns_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index b2fab9afe0..253845d2c1 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -1,6 +1,6 @@ name: Windows System Network Connections Discovery Netsh id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_netsh`AND Processes.process = "* show *" Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*") - by Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_network_connections_discovery_netsh_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_system_network_connections_discovery_netsh_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml index 5826ccaf01..f05d820e02 100644 --- a/detections/endpoint/windows_system_reboot_commandline.yml +++ b/detections/endpoint/windows_system_reboot_commandline.yml @@ -1,6 +1,6 @@ name: Windows System Reboot CommandLine id: 97fc2b60-c8eb-4711-93f7-d26fade3686f -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process IN ("* /r*", "* -r*") Processes.process - IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_reboot_commandline_filter`' + IN ("* /t*","* -t*","* /f*","* -f*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_reboot_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/reboot_logoff_commandline/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/reboot_logoff_commandline/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_remote_discovery_with_query.yml b/detections/endpoint/windows_system_remote_discovery_with_query.yml index 92f1a0f4cf..ba22f537ac 100644 --- a/detections/endpoint/windows_system_remote_discovery_with_query.yml +++ b/detections/endpoint/windows_system_remote_discovery_with_query.yml @@ -1,22 +1,43 @@ name: Windows System Remote Discovery With Query id: 94859172-a521-474f-97ac-4cf4b09634a3 -version: 2 -date: '2025-02-05' +version: 3 +date: '2025-03-27' author: Steven Dick status: production type: Anomaly -description: The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network. -data_source: +description: The following analytic detects the execution of `query.exe` with command-line + arguments aimed at discovering data on remote devices. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on process names and command-line + executions. This activity is significant as adversaries may use `query.exe` to gain + situational awareness and perform Active Directory discovery on compromised endpoints. + If confirmed malicious, this behavior could allow attackers to identify various + details about a system, aiding in further lateral movement and privilege escalation + within the network. +data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: |- - | tstats `security_content_summariesonly` values(Processes.process_current_directory) as Processes.process_current_directory values(Processes.process_id) as Processes.process_id values(Processes.process) as Processes.process values(Processes.parent_process_id) as Processes.parent_process_id values(Processes.parent_process) as Processes.parent_process count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe" OR Processes.original_file_name="query.exe") AND (Processes.process="*/server*") AND NOT Processes.process IN ("*/server:localhost*", "*/server:127.0.0.1*") by Processes.dest Processes.user Processes.process_name Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_system_remote_discovery_with_query_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ + \ as lastTime from datamodel=Endpoint.Processes \nwhere (Processes.process_name=\"\ + query.exe\" OR Processes.original_file_name=\"query.exe\") AND (Processes.process=\"\ + */server*\") AND NOT Processes.process IN (\"*/server:localhost*\", \"*/server:127.0.0.1*\"\ + ) \nby Processes.action Processes.dest Processes.original_file_name Processes.parent_process\ + \ Processes.parent_process_exec \nProcesses.parent_process_guid Processes.parent_process_id\ + \ Processes.parent_process_name \nProcesses.parent_process_path Processes.process\ + \ Processes.process_exec Processes.process_guid Processes.process_hash \nProcesses.process_id\ + \ Processes.process_integrity_level Processes.process_name Processes.process_path\ + \ \nProcesses.user Processes.user_id Processes.vendor_product \n| `drop_dm_object_name(Processes)`\ + \ \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\ + \ \n| `windows_system_remote_discovery_with_query_filter`" +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ @@ -26,11 +47,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate processes on $dest$ - search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = $process_name|s$' +- name: Investigate processes on $dest$ + search: '| from datamodel:Endpoint.Processes | search dest=$dest$ process_name = + $process_name|s$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -46,12 +73,12 @@ rba: - field: process_name type: process_name tags: - analytic_story: + analytic_story: - Active Directory Discovery asset_type: Endpoint - mitre_attack_id: + mitre_attack_id: - T1033 - product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 151b86c366..41381be888 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -1,6 +1,6 @@ name: Windows System Script Proxy Execution Syncappvpublishingserver id: 8dd73f89-682d-444c-8b41-8e679966ad3c -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("wscript.exe","cscript.exe") - Processes.process="*syncappvpublishingserver.vbs*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_script_proxy_execution_syncappvpublishingserver_filter`' + Processes.process="*syncappvpublishingserver.vbs*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_system_script_proxy_execution_syncappvpublishingserver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml index 67eee645fd..3d7bb37155 100644 --- a/detections/endpoint/windows_system_shutdown_commandline.yml +++ b/detections/endpoint/windows_system_shutdown_commandline.yml @@ -1,6 +1,6 @@ name: Windows System Shutdown CommandLine id: 4fee57b8-d825-4bf3-9ea8-bf405cdb614c -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,13 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" AND Processes.process IN("* /s*", "* -s*") AND Processes.process - IN ("* /t*","* -t*","* /f*","* -f*") by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`' + IN ("* /t*","* -t*","* /f*","* -f*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_shutdown_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -77,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/shutdown_commandline/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/shutdown_commandline/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index 261aea1c1d..3424832beb 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -1,6 +1,6 @@ name: Windows System Time Discovery W32tm Delay id: b2cc69e7-11ba-42dc-a269-59c069a48870 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -21,10 +21,14 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process= "* /computer:localhost *" Processes.process= "* /period:*" Processes.process= "* - /dataonly *" Processes.process= "* /samples:*" by Processes.parent_process Processes.process_name - Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_system_time_discovery_w32tm_delay_filter`' + /dataonly *" Processes.process= "* /samples:*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_system_time_discovery_w32tm_delay_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_delay_execution/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_delay_execution/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index 4febcf1910..be76276a35 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -1,6 +1,6 @@ name: Windows System User Discovery Via Quser id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,12 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="quser.exe" - OR Processes.original_file_name = "quser.exe" by Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name - Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user + OR Processes.original_file_name = "quser.exe" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_user_discovery_via_quser_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -55,7 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_user_privilege_discovery.yml b/detections/endpoint/windows_system_user_privilege_discovery.yml index fd3d9d521b..a13b40ba80 100644 --- a/detections/endpoint/windows_system_user_privilege_discovery.yml +++ b/detections/endpoint/windows_system_user_privilege_discovery.yml @@ -1,6 +1,6 @@ name: Windows System User Privilege Discovery id: 8c9a06bc-9939-4425-9bb9-be2371f7fb7e -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -18,10 +18,13 @@ description: The following analytic detects the execution of `whoami.exe` with t privilege escalation or further exploitation within the environment. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="whoami.exe" - Processes.process= "*/priv*" by Processes.dest Processes.user Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_system_user_privilege_discovery_filter`' + Processes.process= "*/priv*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_user_privilege_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/whoami_priv/whoami-priv-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/whoami_priv/whoami-priv-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml index 4ac22b6fea..5c3b5a659e 100644 --- a/detections/endpoint/windows_terminating_lsass_process.yml +++ b/detections/endpoint/windows_terminating_lsass_process.yml @@ -1,6 +1,6 @@ name: Windows Terminating Lsass Process id: 7ab3c319-a4e7-4211-9e8c-40a049d0dba6 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,12 @@ description: The following analytic detects a suspicious process attempting to t data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 | stats - count min(_time) as firstTime max(_time) as lastTime by SourceImage, TargetImage, - TargetProcessId, SourceProcessId, GrantedAccess CallTrace, dest | rename dest as - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess + Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage + TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec + parent_process_guid parent_process_id parent_process_name parent_process_path process_exec + process_guid process_id process_name process_path signature signature_id user_id + vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_terminating_lsass_process_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. @@ -67,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 98d4336217..d5b1b83733 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -1,6 +1,6 @@ name: Windows Time Based Evasion id: 34502357-deb1-499a-8261-ffe144abf561 -version: 6 +version: 7 date: '2025-02-19' author: Teoderick Contreras, Splunk status: production @@ -19,9 +19,13 @@ description: The following analytic detects potentially malicious processes that search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "ping.exe" Processes.parent_process = "* ping 0 -n *" OR Processes.process = "* ping 0 -n *" - by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid - Processes.process Processes.user Processes.dest | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_time_based_evasion_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_time_based_evasion_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -69,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml b/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml index 5453cc7fef..9575ea1ce9 100644 --- a/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml +++ b/detections/endpoint/windows_time_based_evasion_via_choice_exec.yml @@ -1,6 +1,6 @@ name: Windows Time Based Evasion via Choice Exec id: d5f54b38-10bf-4b3a-b6fc-85949862ed50 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,13 @@ description: The following analytic detects the use of choice.exe in batch files promptly. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name =choice.exe Processes.process - = "*/T*" Processes.process = "*/N*" by Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_time_based_evasion_via_choice_exec_filter`' + = "*/T*" Processes.process = "*/N*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_time_based_evasion_via_choice_exec_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/snakekeylogger_choice.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/snakekeylogger_choice.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml index ced7799775..cdebcdb890 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml @@ -1,6 +1,6 @@ name: Windows UAC Bypass Suspicious Child Process id: 453a6b0f-b0ea-48fa-9cf4-20537ffdd22c -version: 6 +version: 7 date: '2025-02-10' author: Steven Dick status: production @@ -22,11 +22,13 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime IN ("high","system") AND Processes.parent_process_name IN (`uacbypass_process_name`) AND (Processes.process_name IN ("cmd.exe","powershell.exe","pwsh.exe","wscript","cscript.exe","bash.exe","werfault.exe") OR Processes.process IN ("*\\\\*","*\\Users\\*","*\\ProgramData\\*","*\\Temp\\*")) - by Processes.dest, Processes.user, Processes.parent_process_guid, Processes.parent_process, - Processes.parent_process_name Processes.process_name Processes.process, Processes.process_path, - Processes.process_integrity_level, Processes.process_current_directory | `drop_dm_object_name(Processes)` - | where parent_process_name != process_name | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_uac_bypass_suspicious_child_process_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | where parent_process_name != process_name | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_uac_bypass_suspicious_child_process_filter`' how_to_implement: Target environment must ingest sysmon data, specifically Event ID 1 with process integrity level data. known_false_positives: Including Werfault.exe may cause some unintended false positives @@ -78,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml index e6c5b3452a..6775a54f1f 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml @@ -1,6 +1,6 @@ name: Windows UAC Bypass Suspicious Escalation Behavior id: 00d050d3-a5b4-4565-a6a5-a31f69681dc3 -version: 7 +version: 8 date: '2025-02-10' author: Steven Dick status: production @@ -14,13 +14,14 @@ description: The following analytic detects when a process spawns an executable confirmed malicious, the attacker could gain elevated privileges, potentially leading to further system compromise and persistent access. data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- Sysmon EventID 1 AND Sysmon EventID 1 search: '| tstats `security_content_summariesonly` count max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_integrity_level IN ("low","medium") - by Processes.dest, Processes.user, Processes.process_name, Processes.process, Processes.process_guid, - Processes.process_path, Processes.process_integrity_level, Processes.process_current_directory + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | eval original_integrity_level = CASE(match(process_integrity_level,"low"),1,match(process_integrity_level,"medium"),2,match(process_integrity_level,"high"),3,match(process_integrity_level,"system"),4,true(),0) | rename process_guid as join_guid_1, process* as parent_process* | join max=0 dest join_guid_1 [| tstats `security_content_summariesonly` count min(_time) as firstTime @@ -35,9 +36,7 @@ search: '| tstats `security_content_summariesonly` count max(_time) as lastTime Processes.process_guid, Processes.process_path, Processes.process_integrity_level, Processes.process_current_directory | `drop_dm_object_name(Processes)` | rename parent_process_guid as join_guid_2 | eval elevated_integrity_level = CASE(match(process_integrity_level,"low"),1,match(process_integrity_level,"medium"),2,match(process_integrity_level,"high"),3,match(process_integrity_level,"system"),4,true(),0)] - | where elevated_integrity_level > original_integrity_level | table dest user parent_process - parent_process_name parent_process_integrity_level process_integrity_level process - process_name uac_process_name count firstTime lastTime | `security_content_ctime(firstTime)` + | where elevated_integrity_level > original_integrity_level | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_uac_bypass_suspicious_escalation_behavior_filter`' how_to_implement: Target environment must ingest sysmon data, specifically Event ID 1 with process integrity level data. @@ -95,7 +94,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 579b67e6d4..90e2892c28 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,6 +1,6 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: '8' +version: '9' date: '2025-02-24' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,12 @@ description: The following analytic detects the creation of potentially maliciou escalation, allowing the attacker to gain elevated privileges and further compromise the target system. search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" - ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") | stats - count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed - SignatureStatus OriginalFileName process_name dest EventCode ProcessId Hashes IMPHASH + ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime + by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index d17df5a5bf..b0c9369d68 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,6 +1,6 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 8 +version: 9 date: '2025-02-26' author: Teoderick Contreras, Splunk data_source: @@ -15,15 +15,17 @@ description: This detection identifies unsigned DLLs loaded through DLL side-loa potential security breaches. Regular security assessments, thorough monitoring, and implementing security best practices are essential in safeguarding systems from such threats. -search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) ImageLoaded = *.dll - | rex field=Image "(?.+\\\)" - | rex field=ImageLoaded "(?.+\\\)" - | where ImageFolderPath = ImageLoadedFolderPath - | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company Description Product Signed SignatureStatus - | rename Computer as dest +search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN + ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*")) + NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program + Files*")) | rex field=Image "(?.+\\\)" | rex field=ImageLoaded + "(?.+\\\)" | where ImageFolderPath = ImageLoadedFolderPath + | stats count min(_time) as firstTime max(_time) as lastTime + by Image ImageLoaded dest loaded_file loaded_file_path + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_unsigned_dll_side_loading_in_same_process_path_filter`' + | `security_content_ctime(lastTime)` | `windows_unsigned_dll_side_loading_in_same_process_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 621a904a38..5bb4b7e9cd 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,6 +1,6 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: '8' +version: '9' date: '2025-02-24' author: Teoderick Contreras, Splunk data_source: @@ -20,9 +20,11 @@ search: '`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false Signa Files*")) NOT (ImageLoaded IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) | rex field=Image "(?.+\\\)" | rex field=ImageLoaded "(?.+\\\)" | where ImageFolderPath = ImageLoadedFolderPath - | stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid - ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company - Description Product Signed SignatureStatus | rename Computer as dest | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime + by Image ImageLoaded dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsigned_ms_dll_side_loading_filter`' how_to_implement: The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml index 63b6bc6fe8..0fa924d07c 100644 --- a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml @@ -2,7 +2,7 @@ name: Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos id: f65aa026-b811-42ab-b4b9-d9088137648f date: '2025-02-10' type: Anomaly -version: 5 +version: 6 status: production author: Mauricio Velazco, Splunk data_source: @@ -40,9 +40,10 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, IpAddress | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) - as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts - > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter`' + as user values(dest) as dest by _time, IpAddress | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter`' rba: message: Potential Kerberos based password spraying attack from $IpAddress$ risk_objects: @@ -67,8 +68,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml index 3526b02f99..e8713bd1db 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml @@ -1,7 +1,7 @@ name: Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos id: f122cb2e-d773-4f11-8399-62a3572d8dd7 type: Anomaly -version: 5 +version: 6 date: '2025-02-10' status: production author: Mauricio Velazco, Splunk @@ -40,9 +40,10 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, IpAddress | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) - as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts - > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter`' + as user values(dest) as dest by _time, IpAddress | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter`' rba: message: Potential Kerberos based password spraying attack from $IpAddress$ risk_objects: @@ -67,8 +68,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml index 5dbcdccc4e..fbfb9e6258 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -1,7 +1,7 @@ name: Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM id: 15603165-147d-4a6e-9778-bd0ff39e668f type: Anomaly -version: 6 +version: 7 status: production date: '2025-02-10' author: Mauricio Velazco, Splunk @@ -43,10 +43,10 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 | bucket span=2m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) - as comp_std by Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts - > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | rename Workstation - as src |`windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`' + as user values(dest) as dest by _time, Workstation | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by Workstation | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | rename Workstation as src |`windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`' rba: message: Potential NTLM based password spraying attack from $src$ risk_objects: @@ -71,8 +71,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml index 8d72b7869c..ec7051a13d 100644 --- a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml @@ -1,7 +1,7 @@ name: Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials id: 14f414cf-3080-4b9b-aaf6-55a4ce947b93 type: Anomaly -version: 6 +version: 7 status: production date: '2025-02-10' author: Mauricio Velazco, Splunk @@ -43,10 +43,10 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ | bucket span=5m _time | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) - as user by _time, Computer, Caller_User_Name | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Computer | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter`' + as user values(dest) as dest values(src_ip) as src_ip by _time, Computer, Caller_User_Name + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std + by Computer | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts + > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter`' rba: message: Potential password spraying attack from $Computer$ risk_objects: @@ -72,8 +72,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml index 8d4f21783d..b452955d86 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml @@ -2,7 +2,7 @@ name: Windows Unusual Count Of Users Failed To Auth Using Kerberos id: bc9cb715-08ba-40c3-9758-6e2b26e455cb date: '2025-02-10' type: Anomaly -version: 5 +version: 6 status: production author: Mauricio Velazco, Splunk data_source: @@ -42,9 +42,10 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 | bucket span=5m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, IpAddress | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) - as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts - > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`' + as user values(dest) as dest by _time, IpAddress | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by IpAddress | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`' rba: message: Potential Kerberos based password spraying attack from $IpAddress$ risk_objects: @@ -69,8 +70,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml index 4390ea59a9..c4401d6f47 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml @@ -1,7 +1,7 @@ name: Windows Unusual Count Of Users Failed To Authenticate From Process id: 25bdb6cb-2e49-4d34-a93c-d6c567c122fe type: Anomaly -version: 6 +version: 7 status: production date: '2025-02-10' author: Mauricio Velazco, Splunk @@ -43,9 +43,10 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" | bucket span=2m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as user by _time, ProcessName, SubjectUserName, Computer | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, SubjectUserName, - Computer | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts + as user values(dest) as dest values(src) as src by _time, ProcessName, SubjectUserName, + Computer, action, app, authentication_method, signature, signature_id | eventstats + avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, + SubjectUserName, Computer | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_unusual_count_of_users_failed_to_authenticate_from_process_filter`' rba: message: Potential password spraying attack from $Computer$ @@ -72,8 +73,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml index 851a0ac391..792688f973 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml @@ -1,7 +1,7 @@ name: Windows Unusual Count Of Users Failed To Authenticate Using NTLM id: 6f6c8fd7-6a6b-4af9-a0e9-57cfc47a58b4 type: Anomaly -version: 6 +version: 7 status: production date: '2025-02-10' author: Mauricio Velazco, Splunk @@ -43,8 +43,8 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A | bucket span=2m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as tried_accounts by _time, Workstation | eventstats avg(unique_accounts) as comp_avg - , stdev(unique_accounts) as comp_std by Workstation | eval upperBound=(comp_avg+comp_std*3) + as tried_accounts values(dest) as dest by _time, Workstation | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`' rba: @@ -68,8 +68,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml index 602d834ebc..eb28b8d512 100644 --- a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml +++ b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml @@ -1,7 +1,7 @@ name: Windows Unusual Count Of Users Remotely Failed To Auth From Host id: cf06a0ee-ffa9-4ed3-be77-0670ed9bab52 type: Anomaly -version: 6 +version: 7 status: production date: '2025-02-10' author: Mauricio Velazco, Splunk @@ -43,10 +43,11 @@ drilldown_searches: latest_offset: $info_max_time$ search: '`wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" | bucket span=2m _time | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) - as tried_accounts by _time, IpAddress, Computer | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter`' + as tried_accounts values(dest) as dest values(src) as src values(user) as user by + _time, IpAddress, Computer, action, app, authentication_method, signature, signature_id + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std + by IpAddress, Computer | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts + > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter`' rba: message: Potential password spraying attack on $Computer$ risk_objects: @@ -68,8 +69,7 @@ tags: security_domain: endpoint tests: - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog name: True Positive Test diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml index 87beb38b68..c02d21c59d 100644 --- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -1,20 +1,29 @@ name: Windows Unusual SysWOW64 Process Run System32 Executable id: e4602172-db86-4315-86df-da66fb40bcde -version: 1 -date: '2025-02-11' +version: 2 +date: '2025-03-27' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects an unusual process execution pattern where a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. In a typical Windows environment, 32-bit processes under SysWOW64 should primarily interact with 32-bit binaries within the same directory. However, an execution flow where a 32-bit process spawns a 64-bit binary from System32 can indicate potential process injection, privilege escalation, evasion techniques, or unauthorized execution hijacking. +description: The following analytic detects an unusual process execution pattern where + a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. + In a typical Windows environment, 32-bit processes under SysWOW64 should primarily + interact with 32-bit binaries within the same directory. However, an execution flow + where a 32-bit process spawns a 64-bit binary from System32 can indicate potential + process injection, privilege escalation, evasion techniques, or unauthorized execution + hijacking. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_path = "*\\Windows\\SysWOW64\\*" AND Processes.process = "*windows\\system32\\*" - by Processes.parent_process_name Processes.process_path Processes.process Processes.original_file_name Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\SysWOW64\\*" + AND Processes.process = "*windows\\system32\\*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_syswow64_process_run_system32_executable_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -25,7 +34,10 @@ how_to_implement: The detection is based on data that originates from Endpoint D the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: some legitimate system processes, software updaters, or compatibility tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual parent processes should be investigated for potential malware activity, persistence mechanisms, or execution flow hijacking. +known_false_positives: some legitimate system processes, software updaters, or compatibility + tools may trigger this behavior, occurrences involving unknown, unsigned, or unusual + parent processes should be investigated for potential malware activity, persistence + mechanisms, or execution flow hijacking. references: - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html drilldown_searches: diff --git a/detections/endpoint/windows_usbstor_registry_key_modification.yml b/detections/endpoint/windows_usbstor_registry_key_modification.yml index a64a1e253b..423db6e48d 100644 --- a/detections/endpoint/windows_usbstor_registry_key_modification.yml +++ b/detections/endpoint/windows_usbstor_registry_key_modification.yml @@ -1,67 +1,86 @@ -name: Windows USBSTOR Registry Key Modification -id: a345980a-417d-4ed3-9fb4-cac30c9405a0 -version: 1 -date: '2025-01-17' -author: Steven Dick -status: production -type: Anomaly -description: This analytic is used to identify when a USB removable media device is attached to a Windows host. In this scenario we are querying the Endpoint Registry data model to look for modifications to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ key. Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration. -data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: |- - | tstats `security_content_summariesonly` values(Registry.registry_value_data) as registry_value_data, values(Registry.registry_value_name) as registry_value_name, min(_time) as firstTime, max(_time) as lastTime, count from datamodel=Endpoint.Registry where Registry.registry_path IN ("HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*") AND Registry.registry_value_name ="FriendlyName" by Registry.dest,Registry.registry_value_data,Registry.registry_path - | `drop_dm_object_name(Registry)` - | eval object_name = registry_value_data, object_handle = split(mvindex(split(registry_path, "\\"),6),"&"), object_handle = mvindex(mvfilter(NOT len(object_handle)=1),0) - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_usbstor_registry_key_modification_filter` -how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model. -known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate. -references: -- https://attack.mitre.org/techniques/T1200/ -- https://www.cisa.gov/news-events/news/using-caution-usb-drives -- https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: Investigate USB events on $dest$ - search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN ("HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*")' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: A removable storage device named [$object_name$] with drive letter [$object_handle$] was attached to $dest$ - risk_objects: - - field: dest - type: system - score: 10 - threat_objects: - - field: object_name - type: registry_value_name - - field: object_handle - type: registry_value_text -tags: - analytic_story: - - Data Protection - asset_type: Endpoint - mitre_attack_id: - - T1200 - - T1025 - - T1091 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog +name: Windows USBSTOR Registry Key Modification +id: a345980a-417d-4ed3-9fb4-cac30c9405a0 +version: 2 +date: '2025-01-17' +author: Steven Dick +status: production +type: Anomaly +description: This analytic is used to identify when a USB removable media device is + attached to a Windows host. In this scenario we are querying the Endpoint Registry + data model to look for modifications to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ + key. Adversaries and Insider Threats may use removable media devices for several + malicious activities, including initial access, execution, and exfiltration. +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +search: "| tstats `security_content_summariesonly` min(_time) as firstTime, max(_time)\ + \ as lastTime, count from datamodel=Endpoint.Registry where Registry.registry_path\ + \ IN (\"HKLM\\\\System\\\\CurrentControlSet\\\\Enum\\\\USBSTOR\\\\*\") \nAND Registry.registry_value_name\ + \ =\"FriendlyName\" \nby Registry.action Registry.dest Registry.process_guid Registry.process_id\ + \ Registry.registry_hive Registry.registry_path \nRegistry.registry_key_name Registry.registry_value_data\ + \ Registry.registry_value_name \nRegistry.registry_value_type Registry.status Registry.user\ + \ Registry.vendor_product \n| `drop_dm_object_name(Registry)`\n| eval object_name\ + \ = registry_value_data, object_handle = split(mvindex(split(registry_path, \"\\\ + \\\"),6),\"&\"), object_handle = mvindex(mvfilter(NOT len(object_handle)=1),0)\n\ + | `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)` \n\ + | `windows_usbstor_registry_key_modification_filter`" +how_to_implement: To successfully implement this search, you must ingest endpoint + logging that tracks changes to the HKLM\System\CurrentControlSet\Enum\USBSTOR\ registry + keys. Ensure that the field from the event logs is being mapped to the proper fields + in the Endpoint.Registry data model. +known_false_positives: Legitimate USB activity will also be detected. Please verify + and investigate as appropriate. +references: +- https://attack.mitre.org/techniques/T1200/ +- https://www.cisa.gov/news-events/news/using-caution-usb-drives +- https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate USB events on $dest$ + search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN + ("HKLM\\System\\CurrentControlSet\\Enum\\USBSTOR\\*")' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A removable storage device named [$object_name$] with drive letter [$object_handle$] + was attached to $dest$ + risk_objects: + - field: dest + type: system + score: 10 + threat_objects: + - field: object_name + type: registry_value_name + - field: object_handle + type: registry_value_text +tags: + analytic_story: + - Data Protection + asset_type: Endpoint + mitre_attack_id: + - T1200 + - T1025 + - T1091 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_user_deletion_via_net.yml b/detections/endpoint/windows_user_deletion_via_net.yml index 32bb43dd91..e4792e9d25 100644 --- a/detections/endpoint/windows_user_deletion_via_net.yml +++ b/detections/endpoint/windows_user_deletion_via_net.yml @@ -1,18 +1,41 @@ name: Windows User Deletion Via Net id: b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e -version: 2 +version: 3 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts or cover tracks during lateral movement. If confirmed malicious, this could lead to unauthorized access removal, disruption of legitimate user activities, or concealment of adversarial actions, complicating incident response and forensic investigations. +description: The following analytic detects the use of net.exe or net1.exe command-line + to delete a user account on a system. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on process and command-line execution logs. + This activity is significant as it may indicate an attempt to impair user accounts + or cover tracks during lateral movement. If confirmed malicious, this could lead + to unauthorized access removal, disruption of legitimate user activities, or concealment + of adversarial actions, complicating incident response and forensic investigations. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/delete*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_deletion_via_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" + AND Processes.process="*/delete*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_deletion_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: @@ -60,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_user_disabled_via_net.yml b/detections/endpoint/windows_user_disabled_via_net.yml index 547248419e..5748936b2b 100644 --- a/detections/endpoint/windows_user_disabled_via_net.yml +++ b/detections/endpoint/windows_user_disabled_via_net.yml @@ -1,17 +1,39 @@ name: Windows User Disabled Via Net id: b0359e05-c87b-4354-83d8-aee0d890243f -version: 2 +version: 3 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the use of the `net.exe` utility to disable a user account via the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate an adversary's attempt to disrupt user availability, potentially as a precursor to further malicious actions. If confirmed malicious, this could lead to denial of service for legitimate users, aiding the attacker in maintaining control or covering their tracks. +description: The following analytic detects the use of the `net.exe` utility to disable + a user account via the command line. It leverages data from Endpoint Detection and + Response (EDR) agents, focusing on process execution logs and command-line arguments. + This activity is significant as it may indicate an adversary's attempt to disrupt + user availability, potentially as a precursor to further malicious actions. If confirmed + malicious, this could lead to denial of service for legitimate users, aiding the + attacker in maintaining control or covering their tracks. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/active:no*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_disabled_via_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" + AND Processes.process="*/active:no*" by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_disabled_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -58,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_user_discovery_via_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml index 670b59cbaa..5120b73f9d 100644 --- a/detections/endpoint/windows_user_discovery_via_net.yml +++ b/detections/endpoint/windows_user_discovery_via_net.yml @@ -1,6 +1,6 @@ name: Windows User Discovery Via Net id: 7742987e-88c1-476b-a626-a869e088ab72 -version: 2 +version: 3 date: '2025-02-10' author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process="*user" OR Processes.process="*users" OR Processes.process="*users *" OR Processes.process="*user - *") AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_discovery_via_net_filter`' + *") AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_user_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -51,7 +55,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml index a9521c99f0..65a41a6789 100644 --- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml +++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml @@ -1,6 +1,6 @@ name: Windows User Execution Malicious URL Shortcut File id: 5c7ee6ad-baf4-44fb-b2f0-0cfeddf82dbc -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,12 @@ data_source: - Sysmon EventID 11 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where NOT(Filesystem.file_path IN - ("*\\Program Files*")) Filesystem.file_name = *.url by Filesystem.file_create_time - Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path - Filesystem.process_guid Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_user_execution_malicious_url_shortcut_file_filter`' + ("*\\Program Files*")) Filesystem.file_name = *.url by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_user_execution_malicious_url_shortcut_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml index f3116312b8..f8179ab443 100644 --- a/detections/endpoint/windows_vulnerable_3cx_software.yml +++ b/detections/endpoint/windows_vulnerable_3cx_software.yml @@ -1,14 +1,12 @@ name: Windows Vulnerable 3CX Software id: f2cc1584-46ee-485b-b905-977c067f36de -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: TTP status: production data_source: - Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 description: The following analytic detects instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x, leveraging Sysmon logs. This detection focuses on identifying vulnerable versions 18.12.407 and 18.12.416 of the 3CX desktop app. Monitoring this @@ -17,9 +15,11 @@ description: The following analytic detects instances of the 3CXDesktopApp.exe w could lead to unauthorized access, code execution, or further compromise of the affected system, posing significant security risks. search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe) FileVersion=18.12.* - | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,process_name, - OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `windows_vulnerable_3cx_software_filter`' + | stats count min(_time) as firstTime max(_time) as lastTime by action dest original_file_name + parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name + parent_process_path process process_exec process_guid process_hash process_id process_integrity_level + process_name process_path user user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_vulnerable_3cx_software_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -72,7 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml index 3cd36fdbad..c682a0a8fe 100644 --- a/detections/endpoint/windows_vulnerable_driver_loaded.yml +++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml @@ -1,6 +1,6 @@ name: Windows Vulnerable Driver Loaded id: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: experimental @@ -15,10 +15,11 @@ description: The following analytic detects the loading of known vulnerable Wind exfiltration. data_source: - Sysmon EventID 6 -search: '`sysmon` EventCode=6 | stats min(_time) as firstTime max(_time) as lastTime - count by dest ImageLoaded | lookup loldrivers driver_name AS ImageLoaded OUTPUT - is_driver driver_description | search is_driver = TRUE | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_vulnerable_driver_loaded_filter`' +search: '`sysmon` EventCode=6 | stats min(_time) as firstTime max(_time) as lastTime + count by ImageLoaded dest dvc process_hash process_path signature signature_id user_id + vendor_product | lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description + | search is_driver = TRUE | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_vulnerable_driver_loaded_filter`' how_to_implement: Sysmon collects driver loads via EventID 6, however you may modify the query to utilize this lookup to identify potentially persistent drivers that are known to be vulnerable. @@ -55,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1014/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_windbg_spawning_autoit3.yml b/detections/endpoint/windows_windbg_spawning_autoit3.yml index 323c29de1d..077b4fb4e7 100644 --- a/detections/endpoint/windows_windbg_spawning_autoit3.yml +++ b/detections/endpoint/windows_windbg_spawning_autoit3.yml @@ -1,6 +1,6 @@ name: Windows WinDBG Spawning AutoIt3 id: 7aec015b-cd69-46c3-85ed-dac152056aa4 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -20,11 +20,15 @@ description: The following analytic identifies instances of the WinDBG process s search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=windbg.exe AND (Processes.process_name IN ("autoit3.exe", "autoit*.exe") OR Processes.original_file_name - IN ("autoit3.exe", "autoit*.exe")) by Processes.dest, Processes.user, Processes.parent_process_name, - Processes.process_name, Processes.original_file_name, Processes.process, Processes.process_id, - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | eval matches_extension=if(match(process, - "\\.(au3|a3x|exe|aut|aup)$"), "Yes", "No") | search matches_extension="Yes" | `windows_windbg_spawning_autoit3_filter`' + IN ("autoit3.exe", "autoit*.exe")) by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval + matches_extension=if(match(process, "\\.(au3|a3x|exe|aut|aup)$"), "Yes", "No") | + search matches_extension="Yes" | `windows_windbg_spawning_autoit3_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/autoit/windbg_autoit.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/autoit/windbg_autoit.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_winlogon_with_public_network_connection.yml b/detections/endpoint/windows_winlogon_with_public_network_connection.yml index 74422a9b7c..0db48f3747 100644 --- a/detections/endpoint/windows_winlogon_with_public_network_connection.yml +++ b/detections/endpoint/windows_winlogon_with_public_network_connection.yml @@ -1,6 +1,6 @@ name: Windows WinLogon with Public Network Connection id: 65615b3a-62ea-4d65-bb9f-6f07c17df4ea -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: experimental @@ -15,16 +15,38 @@ description: The following analytic detects instances of Winlogon.exe, a critica bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN (winlogon.exe) Processes.process!=unknown - by Processes.dest Processes.user Processes.parent_process_name Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id - [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic +search: '| tstats prestats=t `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN (winlogon.exe) Processes.process!=unknown by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 NOT (All_Traffic.dest IN (127.0.0.1,10.0.0.0/8,172.16.0.0/12, - 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port - | `drop_dm_object_name(All_Traffic)` | rename dest as publicIp ] | table dest parent_process_name - process_name process_path process process_id dest_port publicIp | `windows_winlogon_with_public_network_connection_filter`' + 192.168.0.0/16, 0:0:0:0:0:0:0:1)) by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip + All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product + All_Traffic.process_id | `drop_dm_object_name(All_Traffic)` | table action dest + original_file_name parent_process parent_process_exec parent_process_guid parent_process_id + parent_process_name parent_process_path process process_exec process_guid process_hash + process_id process_integrity_level process_name process_path user user_id vendor_product + app dest_ip dest_port direction dvc protocol protocol_version src src_ip src_port + transport | stats values(action) as action values(dest) as dest values(original_file_name) + as original_file_name values(parent_process) as parent_process values(parent_process_exec) + as parent_process_exec values(parent_process_guid) as parent_process_guid values(parent_process_id) + as parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_guid) as process_guid values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(app) as app values(dest_ip) as dest_ip values(dest_port) + as dest_port values(direction) as direction values(dvc) as dvc values(protocol) + as protocol values(protocol_version) as protocol_version values(src) as src values(src_ip) + as src_ip values(src_port) as src_port values(transport) as transport by process_id + | where isnotnull(process_name) AND isnotnull(dest_port) | `windows_winlogon_with_public_network_connection_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -53,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542.003/bootkits/network-winlogon-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542.003/bootkits/network-winlogon-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index eeabb1c807..32dca81048 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -1,6 +1,6 @@ name: Windows WMI Impersonate Token id: cf192860-2d94-40db-9a51-c04a2e8a8f8b -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -15,9 +15,12 @@ description: The following analytic detects potential WMI token impersonation ac data_source: - Sysmon EventID 10 search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", - "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage - TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId - GrantedAccess CallTrace dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace + EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID + SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access + parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path + process_exec process_guid process_id process_name process_path signature signature_id + user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_impersonate_token_filter`' how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly @@ -66,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_wmi_process_and_service_list.yml b/detections/endpoint/windows_wmi_process_and_service_list.yml index 7282dac398..0b951966f1 100644 --- a/detections/endpoint/windows_wmi_process_and_service_list.yml +++ b/detections/endpoint/windows_wmi_process_and_service_list.yml @@ -1,6 +1,6 @@ name: Windows WMI Process And Service List id: ef3c5ef2-3f6d-4087-aa75-49bf746dc907 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,11 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process - IN ("*process list*", "*service list*") by Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name - Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_wmi_process_and_service_list_filter`' + IN ("*process list*", "*service list*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_process_and_service_list_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 09fcfa736a..ddf2e92249 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -1,6 +1,6 @@ name: Windows WMI Process Call Create id: 0661c2de-93de-11ec-9833-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -20,11 +20,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process = "* process *" Processes.process = "* call *" Processes.process = "* create *" - by Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_path - Processes.process_guid Processes.parent_process_id Processes.dest Processes.user - Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_wmi_process_call_create_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_wmi_process_call_create_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -58,7 +60,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml b/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml index b56b0234f5..58f9d95f24 100644 --- a/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml +++ b/detections/endpoint/windows_wpdbusenum_registry_key_modification.yml @@ -1,67 +1,89 @@ -name: Windows WPDBusEnum Registry Key Modification -id: 52b48e8b-eb6e-48b0-b8f1-73273f6b134e -version: 1 -date: '2025-01-17' -author: Steven Dick -status: production -type: Anomaly -description: This analytic is used to identify when a USB removable media device is attached to a Windows host. In this scenario we are querying the Endpoint Registry data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ . Adversaries and Insider Threats may use removable media devices for several malicious activities, including initial access, execution, and exfiltration. -data_source: -- Sysmon EventID 12 -- Sysmon EventID 13 -search: |- - | tstats `security_content_summariesonly` latest(Registry.registry_path) as registry_path, values(Registry.registry_value_name) as registry_value_name, min(_time) as firstTime, max(_time) as lastTime, count from datamodel=Endpoint.Registry where Registry.registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*") AND Registry.registry_value_name ="FriendlyName" AND Registry.registry_path="*USBSTOR*" by Registry.dest,Registry.registry_value_data - | `drop_dm_object_name(Registry)` - | eval object_handle = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path, "??"),1),"&"),2),"PROD_","") - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_wpdbusenum_registry_key_modification_filter` -how_to_implement: To successfully implement this search, you must ingest endpoint logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys. Ensure that the field from the event logs is being mapped to the proper fields in the Endpoint.Registry data model. -known_false_positives: Legitimate USB activity will also be detected. Please verify and investigate as appropriate. -references: -- https://attack.mitre.org/techniques/T1200/ -- https://www.cisa.gov/news-events/news/using-caution-usb-drives -- https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/ -drilldown_searches: -- name: View the detection results for - "$dest$" - search: '%original_detection_search% | search dest = "$dest$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: Investigate USB events on $dest$ - search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: A removable storage device named [$object_name$] with drive letter [$object_handle$] was attached to $dest$ - risk_objects: - - field: dest - type: system - score: 10 - threat_objects: - - field: object_name - type: registry_value_name - - field: object_handle - type: registry_value_text -tags: - analytic_story: - - Data Protection - asset_type: Endpoint - mitre_attack_id: - - T1200 - - T1025 - - T1091 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog +name: Windows WPDBusEnum Registry Key Modification +id: 52b48e8b-eb6e-48b0-b8f1-73273f6b134e +version: 2 +date: '2025-01-17' +author: Steven Dick +status: production +type: Anomaly +description: This analytic is used to identify when a USB removable media device is + attached to a Windows host. In this scenario we are querying the Endpoint Registry + data model to look for modifications to the Windows Portable Device keys HKLM\SOFTWARE\Microsoft\Windows + Portable Devices\Devices\ or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ + . Adversaries and Insider Threats may use removable media devices for several malicious + activities, including initial access, execution, and exfiltration. +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +search: "| tstats `security_content_summariesonly` min(_time) as firstTime, max(_time)\ + \ as lastTime, count from datamodel=Endpoint.Registry \nwhere Registry.registry_path\ + \ IN (\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows Portable Devices\\\\Devices\\\\\ + *\",\"HKLM\\\\System\\\\CurrentControlSet\\\\Enum\\\\SWD\\\\WPDBUSENUM\\\\*\") \n\ + AND Registry.registry_value_name =\"FriendlyName\" AND Registry.registry_path=\"\ + *USBSTOR*\" \nby Registry.action Registry.dest Registry.process_guid Registry.process_id\ + \ Registry.registry_hive Registry.registry_path \nRegistry.registry_key_name Registry.registry_value_data\ + \ Registry.registry_value_name \nRegistry.registry_value_type Registry.status Registry.user\ + \ Registry.vendor_product \n| `drop_dm_object_name(Registry)`\n| eval object_handle\ + \ = registry_value_data, object_name = replace(mvindex(split(mvindex(split(registry_path,\ + \ \"??\"),1),\"&\"),2),\"PROD_\",\"\")\n| `security_content_ctime(firstTime)`\ + \ \n| `security_content_ctime(lastTime)`\n| `windows_wpdbusenum_registry_key_modification_filter`" +how_to_implement: To successfully implement this search, you must ingest endpoint + logging that tracks changes to the HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\ + or HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM\ registry keys. Ensure that + the field from the event logs is being mapped to the proper fields in the Endpoint.Registry + data model. +known_false_positives: Legitimate USB activity will also be detected. Please verify + and investigate as appropriate. +references: +- https://attack.mitre.org/techniques/T1200/ +- https://www.cisa.gov/news-events/news/using-caution-usb-drives +- https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: Investigate USB events on $dest$ + search: '| from datamodel:Endpoint.Registry | search dest=$dest$ registry_path IN + ("HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\*","HKLM\\System\\CurrentControlSet\\Enum\\SWD\\WPDBUSENUM\\*")' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A removable storage device named [$object_name$] with drive letter [$object_handle$] + was attached to $dest$ + risk_objects: + - field: dest + type: system + score: 10 + threat_objects: + - field: object_name + type: registry_value_name + - field: object_handle + type: registry_value_text +tags: + analytic_story: + - Data Protection + asset_type: Endpoint + mitre_attack_id: + - T1200 + - T1025 + - T1091 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 71018871f9..5ba81f4dcf 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Winhlp32 Spawning a Process id: d17dae9e-2618-11ec-b9f5-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe - Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest - Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`' + Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `winhlp32_spawning_a_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winrar_spawning_shell_application.yml b/detections/endpoint/winrar_spawning_shell_application.yml index 104bc4f1d3..45d3c5d31d 100644 --- a/detections/endpoint/winrar_spawning_shell_application.yml +++ b/detections/endpoint/winrar_spawning_shell_application.yml @@ -1,6 +1,6 @@ name: WinRAR Spawning Shell Application id: d2f36034-37fa-4bd4-8801-26807c15540f -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -20,8 +20,11 @@ description: The following analytic detects the execution of Windows shell proce search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winrar.exe `windows_shells` OR Processes.process_name IN ("certutil.exe","mshta.exe","bitsadmin.exe") - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrar_spawning_shell_application_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -90,7 +93,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/winrar.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/winrar.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winrm_spawning_a_process.yml b/detections/endpoint/winrm_spawning_a_process.yml index f7edd2a522..91cb465db0 100644 --- a/detections/endpoint/winrm_spawning_a_process.yml +++ b/detections/endpoint/winrm_spawning_a_process.yml @@ -1,6 +1,6 @@ name: WinRM Spawning a Process id: a081836a-ba4d-11eb-8593-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Drew Church, Michael Haag, Splunk status: experimental @@ -19,9 +19,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wsmprovhost.exe Processes.process_name IN ("cmd.exe","sh.exe","bash.exe","powershell.exe","pwsh.exe","schtasks.exe","certutil.exe","whoami.exe","bitsadmin.exe","scp.exe") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winrm_spawning_a_process_filter`' + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `winrm_spawning_a_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index c21bc05de0..b2df018c3e 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,6 +1,6 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 6 +version: 7 date: '2025-02-10' author: Rico Valdez, Michael Haag, Splunk status: production @@ -15,8 +15,10 @@ description: The following analytic identifies the creation of WMI permanent eve and execute arbitrary code, posing a severe threat to the environment. data_source: - Sysmon EventID 21 -search: '`sysmon` EventCode=21 | rename host as dest | table _time, dest, user, Operation, - EventType, Query, Consumer, Filter | `wmi_permanent_event_subscription___sysmon_filter`' +search: '`sysmon` EventCode=21 | stats count min(_time) as firstTime max(_time) as + lastTime by dest dvc object object_attrs object_category object_path signature signature_id + src status user user_id vendor_product Consumer ConsumerNoQuotes Filter FilterNoQuotes + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmi_permanent_event_subscription___sysmon_filter`' how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least @@ -66,7 +68,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index a9610ec77c..5166973e06 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -1,6 +1,6 @@ name: WMI Recon Running Process Or Services id: b5cd5526-cce7-11eb-b3bd-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,10 +16,10 @@ description: The following analytic identifies suspicious PowerShell script exec data_source: - Powershell Script Block Logging 4104 search: '`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" - OR ScriptBlockText="*Win32_Service*") | stats count min(_time) as firstTime max(_time) - as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest - | rename UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `wmi_recon_running_process_or_services_filter`' + OR ScriptBlockText="*Win32_Service*") | fillnull | stats count min(_time) as firstTime + max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID + Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -30,13 +30,13 @@ references: - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ drilldown_searches: -- name: View the detection results for - "$dest$" and "$user$" - search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user_id$" + search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$dest$" and "$user$" +- name: View risk events for the last 7 days for - "$dest$" and "$user_id$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + "$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" @@ -44,14 +44,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious powerShell script execution by $user$ on $dest$ via EventCode + message: Suspicious powerShell script execution by $user_id$ on $dest$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services risk_objects: - field: dest type: system score: 20 - - field: user + - field: user_id type: user score: 20 threat_objects: [] @@ -71,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 3d38511475..b233de99f3 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -1,6 +1,6 @@ name: Wmic Group Discovery id: 83317b08-155b-11ec-8e00-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,13 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe - (Processes.process="*group get name*") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.original_file_name Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`' + (Processes.process="*group get name*") by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -50,7 +53,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml index cb48b0dacc..b3cd150460 100644 --- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -1,6 +1,6 @@ name: Wmic NonInteractive App Uninstallation id: bff0e7a0-317f-11ec-ab4e-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -20,10 +20,14 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe Processes.process="* product *" Processes.process="*where name*" Processes.process="*call - uninstall*" Processes.process="*/nointeractive*" by Processes.dest Processes.user - Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`' + uninstall*" Processes.process="*/nointeractive*" by Processes.action Processes.dest + Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `wmic_noninteractive_app_uninstallation_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -52,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index a9fa113597..3cf8d44c39 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -1,6 +1,6 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process - IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.parent_process_name - Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id - Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`' + IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `wmic_xsl_execution_via_url_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml index 1910e3c595..0258aa372f 100644 --- a/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_lolbas_execution_process_spawn.yml @@ -1,6 +1,6 @@ name: Wmiprsve LOLBAS Execution Process Spawn id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production @@ -29,10 +29,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", - "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`' + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `wmiprsve_lolbas_execution_process_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -83,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 931de61b80..551bad38df 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -1,6 +1,6 @@ name: Wscript Or Cscript Suspicious Child Process id: 1f35e1da-267b-11ec-90a9-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,8 +18,11 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","pwsh.exe","wmic.exe","mshta.exe") - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wscript_or_cscript_suspicious_child_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml index 9ae72bafa1..b71e5f878d 100644 --- a/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml @@ -1,6 +1,6 @@ name: Wsmprovhost LOLBAS Execution Process Spawn id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af -version: 5 +version: 6 date: '2025-02-10' author: Mauricio Velazco, Splunk status: production @@ -29,10 +29,14 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Rundll32.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Explorer.exe", "Installutil.exe", "Netsh.exe", - "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.dest - Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`' + "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `wsmprovhost_lolbas_execution_process_spawn_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -84,7 +88,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index 1879fa36d4..28fb931288 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -1,6 +1,6 @@ name: WSReset UAC Bypass id: 8b5901bc-da63-11eb-be43-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Steven Dick, Teoderick Contreras, Splunk status: production @@ -14,21 +14,16 @@ description: The following analytic detects a suspicious modification of the reg If confirmed malicious, this could lead to unauthorized code execution and potential system compromise. data_source: -- Sysmon EventID 1 AND Sysmon EventID 12 -- Sysmon EventID 1 AND Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +- Sysmon EventID 12 +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name - = "DelegateExecute") by _time span=1h Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`' + = "DelegateExecute") by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data + Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user + Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 2c08457e9e..f110804a47 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -1,6 +1,6 @@ name: XMRIG Driver Loaded id: 90080fa6-a8df-11eb-91e4-acde48001122 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,9 @@ description: The following analytic detects the installation of the XMRIG coinmi data_source: - Sysmon EventID 6 search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" - | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded - Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `xmrig_driver_loaded_filter`' + | stats min(_time) as firstTime max(_time) as lastTime count by ImageLoaded dest + dvc process_hash process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `xmrig_driver_loaded_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -62,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 28584c4d66..322617c02e 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -1,6 +1,6 @@ name: XSL Script Execution With WMIC id: 004e32e2-146d-11ec-a83f-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -19,10 +19,14 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process - = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process_id Processes.process - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`' + = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.action + Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `xsl_script_execution_with_wmic_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -82,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml similarity index 78% rename from detections/endpoint/3cx_supply_chain_attack_network_indicators.yml rename to detections/network/3cx_supply_chain_attack_network_indicators.yml index a99649df6a..36d2446b20 100644 --- a/detections/endpoint/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml @@ -1,6 +1,6 @@ name: 3CX Supply Chain Attack Network Indicators id: 791b727c-deec-4fbe-a732-756131b3c5a1 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk type: TTP @@ -15,10 +15,11 @@ description: The following analytic identifies DNS queries to domains associated malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches. -search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) - as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name(DNS)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup - 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime from datamodel=Network_Resolution + by DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src + DNS.vendor_product | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | lookup 3cx_ioc_domains domain as query OUTPUT + Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter`' how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed. @@ -55,7 +56,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml b/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml index 0ed2b61a5b..0f12c92d4d 100644 --- a/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml +++ b/detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml @@ -1,23 +1,31 @@ name: Detect DNS Query to Decommissioned S3 Bucket id: 2f1c5fd1-4b8a-4f5d-a0e9-7d6a8e2f5e1e -version: 1 +version: 2 date: '2025-02-12' author: Jose Hernandez, Splunk status: experimental type: Anomaly -description: This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. This activity is significant because attackers may attempt to recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications. +description: This detection identifies DNS queries to domains that match previously + decommissioned S3 buckets. This activity is significant because attackers may attempt + to recreate deleted S3 buckets that were previously public to hijack them for malicious + purposes. If successful, this could allow attackers to host malicious content or + exfiltrate data through compromised bucket names that may still be referenced by + legitimate applications. data_source: - Sysmon EventID 22 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=QUERY by DNS.query DNS.src -| `drop_dm_object_name("DNS")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| eval bucket_domain = lower(query) -| lookup decommissioned_buckets bucketName as bucket_domain OUTPUT bucketName as match -| where isnotnull(match) -| `detect_dns_query_to_decommissioned_s3_bucket_filter`' -how_to_implement: To successfully implement this detection, you need to be ingesting DNS query logs and have them mapped to the Network_Resolution data model. Additionally, ensure that the baseline search "Baseline Of Open S3 Bucket Decommissioning" is running and populating the decommissioned_buckets KVstore lookup. -known_false_positives: Some applications or scripts may continue to reference old S3 bucket names after they have been decommissioned. These should be investigated and updated to prevent potential security risks. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Network_Resolution where DNS.message_type=QUERY by DNS.answer + DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product + | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | eval bucket_domain = lower(query) | lookup decommissioned_buckets bucketName as + bucket_domain OUTPUT bucketName as match | where isnotnull(match) | `detect_dns_query_to_decommissioned_s3_bucket_filter`' +how_to_implement: To successfully implement this detection, you need to be ingesting + DNS query logs and have them mapped to the Network_Resolution data model. Additionally, + ensure that the baseline search "Baseline Of Open S3 Bucket Decommissioning" is + running and populating the decommissioned_buckets KVstore lookup. +known_false_positives: Some applications or scripts may continue to reference old + S3 bucket names after they have been decommissioned. These should be investigated + and updated to prevent potential security risks. references: - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html - https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/ @@ -27,7 +35,8 @@ drilldown_searches: earliest_offset: -7d@d latest_offset: now rba: - message: A DNS query to decommissioned S3 bucket $query$ was detected from host $src$ + message: A DNS query to decommissioned S3 bucket $query$ was detected from host + $src$ risk_objects: - field: src type: system diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index c5f4d94b92..19179c4a66 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -1,6 +1,6 @@ name: Detect hosts connecting to dynamic domain providers id: a1e761ac-1344-4dbd-88b2-3f34c912d359 -version: 6 +version: 7 date: '2024-11-15' author: Bhavin Patel, Splunk status: production @@ -15,34 +15,36 @@ description: The following analytic identifies DNS queries from internal hosts t access to the network. data_source: - Sysmon EventID 22 -search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer - min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host | `drop_dm_object_name("DNS")` - | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' -how_to_implement: "First, you'll need to ingest data from your DNS operations. This - can be done by ingesting logs from your server or data, collected passively by Splunk - Stream or a similar solution. Specifically, data that contains the domain that is - being queried and the IP of the host originating the request must be populating - the `Network_Resolution` data model. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`, - which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating - the local lookup periodically by adding new domains to the list of `dynamic_dns_providers_local.csv`.\n - This search produces fields (query, answer, isDynDNS) that are not yet supported - by ES Incident Review and therefore cannot be viewed when a finding is raised. - These fields contribute additional context to the finding. To see the additional - metadata, add the following fields, if not already present, to Incident Review. - Event Attributes (Configure > Incident Management > Incident Review Settings > Add - New Entry):\n* **Label:** DNS Query, **Field:** query\n* **Label:** DNS Answer, - **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS\n" +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime from + datamodel=Network_Resolution by DNS.answer DNS.answer_count DNS.query DNS.query_count + DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` + | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' +how_to_implement: "First, you'll need to ingest data from your DNS operations. This\ + \ can be done by ingesting logs from your server or data, collected passively by\ + \ Splunk Stream or a similar solution. Specifically, data that contains the domain\ + \ that is being queried and the IP of the host originating the request must be populating\ + \ the `Network_Resolution` data model. This search also leverages a lookup file,\ + \ `dynamic_dns_providers_default.csv`, which contains a non-exhaustive list of Dynamic\ + \ DNS providers. Please consider updating the local lookup periodically by adding\ + \ new domains to the list of `dynamic_dns_providers_local.csv`.\n This search produces\ + \ fields (query, answer, isDynDNS) that are not yet supported by ES Incident Review\ + \ and therefore cannot be viewed when a finding is raised. These fields contribute\ + \ additional context to the finding. To see the additional metadata, add the following\ + \ fields, if not already present, to Incident Review. Event Attributes (Configure\ + \ > Incident Management > Incident Review Settings > Add New Entry):\n* **Label:**\ + \ DNS Query, **Field:** query\n* **Label:** DNS Answer, **Field:** answer\n* **Label:**\ + \ IsDynamicDNS, **Field:** isDynDNS\n" known_false_positives: Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified. references: [] drilldown_searches: -- name: View the detection results for - "$host$" - search: '%original_detection_search% | search host = "$host$"' +- name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$host$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") +- name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) @@ -51,10 +53,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A dns query $query$ from your infra connecting to suspicious domain in - host $host$ + message: A dns query $query$ from your infra connecting to suspicious domain risk_objects: - - field: host + - field: src type: system score: 56 threat_objects: [] @@ -77,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/network/detect_large_icmp_traffic.yml b/detections/network/detect_large_icmp_traffic.yml index 65fbceadb3..0590dc2aab 100644 --- a/detections/network/detect_large_icmp_traffic.yml +++ b/detections/network/detect_large_icmp_traffic.yml @@ -11,7 +11,8 @@ data_source: search: |- | tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) as action from datamodel=Network_Traffic where All_Traffic.bytes > 1000 AND All_Traffic.action != blocked AND (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") - by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.protocol All_Traffic.bytes + by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.protocol, All_Traffic.bytes, All_Traffic.app, All_Traffic.bytes_in, All_Traffic.bytes_out, All_Traffic.dest_port, All_Traffic.dvc, All_Traffic.protocol_version, + All_Traffic.src_port, All_Traffic.user, All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | iplocation dest_ip | `security_content_ctime(firstTime)` diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 03e2420676..99cc44092d 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -1,7 +1,7 @@ name: Detect Outbound LDAP Traffic id: 5e06e262-d7cd-4216-b2f8-27b437e18458 -version: 5 -date: '2025-01-23' +version: 6 +date: '2025-03-27' author: Bhavin Patel, Johan Bjerke, Splunk status: production type: Hunting @@ -18,7 +18,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) - by All_Traffic.src_ip All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` + by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`detect_outbound_ldap_traffic_filter`' how_to_implement: In order to properly run this search, Splunk needs to ingest data @@ -47,7 +50,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log sourcetype: pan:traffic source: pan:traffic diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index 0e0acc3144..be0a4efcf9 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -1,6 +1,6 @@ name: Detect Outbound SMB Traffic id: 1bed7774-304a-4e8f-9d72-d80e45ff492b -version: 8 +version: 9 date: '2025-02-10' author: Bhavin Patel, Stuart Hopkins, Patrick Bareiss status: experimental @@ -13,18 +13,20 @@ description: The following analytic detects outbound SMB (Server Message Block) a key step in lateral movement and privilege escalation. If confirmed malicious, this activity could lead to unauthorized access to sensitive data and potential full system compromise. -data_source: [] -search: >- - | tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time) +data_source: +- Zeek Conn +search: '| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time) as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app values(sourcetype) as sourcetype count from datamodel=Network_Traffic where (All_Traffic.action=allowed All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb") AND All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","100.64.0.0/10") - by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port - | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(start_time)` | - `security_content_ctime(end_time)` | iplocation dest_ip - | `detect_outbound_smb_traffic_filter` + by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | + `security_content_ctime(start_time)` | `security_content_ctime(end_time)` | iplocation + dest_ip | `detect_outbound_smb_traffic_filter`' how_to_implement: This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model known_false_positives: It is likely that the outbound Server Message Block (SMB) traffic @@ -61,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.002/outbound_smb_traffic/zeek_conn.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.002/outbound_smb_traffic/zeek_conn.log sourcetype: bro:conn:json source: conn.log diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index f7744a4f63..8601276d56 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 6 +version: 7 date: '2024-11-15' author: Steven Dick status: production @@ -15,12 +15,12 @@ description: The following analytic detects DNS queries to domains associated wi data_source: - Sysmon EventID 22 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution by DNS.src - DNS.query | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | lookup remote_access_software remote_domain - AS query OUTPUT isutility, description as signature, comment_reference as desc, - category | eval dest = query | search isutility = True | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_dns_filter`' + as lastTime from datamodel=Network_Resolution by DNS.answer DNS.answer_count DNS.query + DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup + remote_access_software remote_domain AS query OUTPUT isutility, description as signature, + comment_reference as desc, category | eval dest = query | search isutility = True + | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_dns_filter`' how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also @@ -52,7 +52,7 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate traffic to $query$ +- name: Investigate traffic to $query$ search: '| from datamodel:Network_Resolution.DNS | search src=$src$ query=$query$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -86,7 +86,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 526fe6f906..b655b82716 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 6 +version: 7 date: '2024-11-15' author: Steven Dick status: production @@ -17,11 +17,14 @@ data_source: - Palo Alto Network Traffic search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(user) as user from - datamodel=Network_Traffic by All_Traffic.src All_Traffic.dest, All_Traffic.app | - `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_appid AS app OUTPUT isutility, description - as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_traffic_filter`' + datamodel=Network_Traffic by All_Traffic.action All_Traffic.app All_Traffic.bytes + All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip + All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version + All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | lookup remote_access_software remote_appid + AS app OUTPUT isutility, description as signature, comment_reference as desc, category + | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter`' how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field @@ -52,7 +55,7 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate application traffic for $app$ +- name: Investigate application traffic for $app$ search: '| from datamodel:Network_Traffic.All_Traffic | search src=$src$ app=$app$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -65,7 +68,7 @@ rba: score: 25 - field: user type: user - score: 25 + score: 25 threat_objects: - field: signature type: signature @@ -87,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo_traffic.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo_traffic.log source: screenconnect_palo_traffic sourcetype: pan:traffic diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 686ce2e6d7..198faa4369 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -1,6 +1,6 @@ name: DNS Query Length With High Standard Deviation id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 -version: 9 +version: 10 date: '2025-02-10' author: Bhavin Patel, Splunk status: production @@ -16,11 +16,12 @@ description: The following analytic identifies DNS queries with unusually large data_source: - Sysmon EventID 22 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution - where NOT DNS.record_type IN("Pointer","PTR") by DNS.query host| `drop_dm_object_name("DNS")` + where NOT DNS.record_type IN("Pointer","PTR") by DNS.answer DNS.answer_count DNS.query + DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product host | `drop_dm_object_name("DNS")` | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24 | eval query_length = len(query) | table host query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS - avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev + avg p50(query_length) AS p50 | where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter`' how_to_implement: To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. @@ -64,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/network/internal_horizontal_port_scan.yml b/detections/network/internal_horizontal_port_scan.yml index a694e24f75..87f81039c7 100644 --- a/detections/network/internal_horizontal_port_scan.yml +++ b/detections/network/internal_horizontal_port_scan.yml @@ -1,6 +1,6 @@ name: Internal Horizontal Port Scan id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1 -version: 4 +version: 5 date: '2024-11-15' author: Dean Luxton status: production @@ -15,17 +15,17 @@ description: This analytic identifies instances where an internal host has attem behavior promptly, enhancing network security and preventing potential threats. search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as - dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic - where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.src_ip - All_Traffic.dest_port All_Traffic.dest_ip span=1s _time All_Traffic.transport | - `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime | stats - min(_time) as _time values(action) as action dc(dest_ip) as totalDestIPCount values(src_category) - as src_category values(dest_zone) as dest_zone values(src_zone) as src_zone by src_ip - dest_port gtime transport | where totalDestIPCount>=250 | eval dest_port=transport - + "/" + dest_port | stats min(_time) as _time values(action) as action sum(totalDestIPCount) - as totalDestIPCount values(src_category) as src_category values(dest_port) as dest_ports - values(dest_zone) as dest_zone values(src_zone) as src_zone by src_ip gtime | fields - - gtime | `internal_horizontal_port_scan_filter`' + dest_zone values(All_Traffic.src_zone) as src_zone values(All_Traffic.src_port) + as src_port count from datamodel=Network_Traffic where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") + by All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip span=1s _time All_Traffic.transport + | `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime | + stats min(_time) as _time values(action) as action dc(dest_ip) as totalDestIPCount + values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone) + as src_zone by src_ip dest_port gtime transport | where totalDestIPCount>=250 | + eval dest_port=transport + "/" + dest_port | stats min(_time) as _time values(action) + as action sum(totalDestIPCount) as totalDestIPCount values(src_category) as src_category + values(dest_port) as dest_ports values(dest_zone) as dest_zone values(src_zone) + as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_filter`' how_to_implement: To properly run this search, Splunk needs to ingest data from networking telemetry sources such as firewalls, NetFlow, or host-based networking events. Ensure that the Network_Traffic data model is populated to enable this search effectively. @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log source: aws:cloudwatchlogs:vpcflow sourcetype: aws:cloudwatchlogs:vpcflow diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index 42b955182e..1dee1933a2 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -1,6 +1,6 @@ name: Internal Horizontal Port Scan NMAP Top 20 id: 3141a041-4f57-4277-9faa-9305ca1f8e5b -version: 2 +version: 3 date: '2024-11-15' author: Dean Luxton status: production @@ -13,20 +13,21 @@ description: This analytic identifies instances where an internal host has attem or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats. -search: >- - | tstats `security_content_summariesonly` values(All_Traffic.action) as action values(All_Traffic.src_category) - as src_category values(All_Traffic.dest_zone) as dest_zone values(All_Traffic.src_zone) - as src_zone count from datamodel=Network_Traffic where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") +search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action + values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as + dest_zone values(All_Traffic.src_zone) as src_zone values(All_Traffic.src_port) + as src_port count from datamodel=Network_Traffic where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") AND All_Traffic.dest_port IN (21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, - 445, 993, 995, 1723, 3306, 3389, 5900, 8080) by All_Traffic.src_ip All_Traffic.dest_port - All_Traffic.dest_ip span=1s _time All_Traffic.transport | `drop_dm_object_name("All_Traffic")` | - eval gtime=_time | bin span=1h gtime | stats min(_time) as _time values(action) - as action dc(dest_ip) as totalDestIPCount values(src_category) as src_category values(dest_zone) - as dest_zone values(src_zone) as src_zone by src_ip dest_port gtime transport | - where totalDestIPCount>=250 | eval dest_port=transport + "/" + dest_port | stats - min(_time) as _time values(action) as action sum(totalDestIPCount) as totalDestIPCount - values(src_category) as src_category values(dest_port) as dest_ports values(dest_zone) - as dest_zone values(src_zone) as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_nmap_top_20_filter` + 445, 993, 995, 1723, 3306, 3389, 5900, 8080) by All_Traffic.src_ip All_Traffic.src + All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.dest span=1s _time All_Traffic.transport | + `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime | + stats min(_time) as _time values(action) as action dc(dest_ip) as totalDestIPCount + values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone) + as src_zone by src_ip dest_port gtime transport | where totalDestIPCount>=250 | + eval dest_port=transport + "/" + dest_port | stats min(_time) as _time values(action) + as action sum(totalDestIPCount) as totalDestIPCount values(src_category) as src_category + values(dest_port) as dest_ports values(dest_zone) as dest_zone values(src_zone) + as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_nmap_top_20_filter`' how_to_implement: To properly run this search, Splunk needs to ingest data from networking telemetry sources such as firewalls, NetFlow, or host-based networking events. Ensure that the Network_Traffic data model is populated to enable this search effectively. @@ -68,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log source: aws:cloudwatchlogs:vpcflow sourcetype: aws:cloudwatchlogs:vpcflow diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml index ecee156769..bc04d556ce 100644 --- a/detections/network/internal_vertical_port_scan.yml +++ b/detections/network/internal_vertical_port_scan.yml @@ -1,6 +1,6 @@ name: Internal Vertical Port Scan id: 40d2dc41-9bbf-421a-a34b-8611271a6770 -version: 3 +version: 4 date: '2024-11-15' author: Dean Luxton status: production @@ -15,16 +15,16 @@ description: This analytic detects instances where an internal host attempts to by identifying and mitigating potential threats promptly. search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as - dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic - where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.src_ip - All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.transport span=1s _time | - `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime | stats - min(_time) as _time values(action) as action dc(eval(if(dest_port<1024 AND transport="tcp",dest_port,null))) - as privilegedDestTcpPortCount dc(eval(if(transport="tcp",dest_port,null))) as totalDestTcpPortCount - dc(eval(if(dest_port<1024 AND transport="udp",dest_port,null))) as privilegedDestUdpPortCount - dc(eval(if(transport="udp",dest_port,null))) as totalDestUdpPortCount values(src_category) - as src_category values(dest_zone) as dest_zone values(src_zone) as src_zone by src_ip - dest_ip transport gtime | eval totalDestPortCount=totalDestUdpPortCount+totalDestTcpPortCount, + dest_zone values(All_Traffic.src_zone) as src_zone values(All_Traffic.src_port) + as src_port count from datamodel=Network_Traffic where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") + by All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.transport + span=1s _time | `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h + gtime | stats min(_time) as _time values(action) as action dc(eval(if(dest_port<1024 + AND transport="tcp",dest_port,null))) as privilegedDestTcpPortCount dc(eval(if(transport="tcp",dest_port,null))) + as totalDestTcpPortCount dc(eval(if(dest_port<1024 AND transport="udp",dest_port,null))) + as privilegedDestUdpPortCount dc(eval(if(transport="udp",dest_port,null))) as totalDestUdpPortCount + values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone) + as src_zone by src_ip dest_ip transport gtime | eval totalDestPortCount=totalDestUdpPortCount+totalDestTcpPortCount, privilegedDestPortCount=privilegedDestTcpPortCount+privilegedDestUdpPortCount| where (totalDestPortCount>=500 AND privilegedDestPortCount>=20) | fields - gtime | `internal_vertical_port_scan_filter`' how_to_implement: To properly run this search, Splunk needs to ingest data from networking @@ -67,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/vertical.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/vertical.log source: aws:cloudwatchlogs:vpcflow sourcetype: aws:cloudwatchlogs:vpcflow diff --git a/detections/network/ngrok_reverse_proxy_on_network.yml b/detections/network/ngrok_reverse_proxy_on_network.yml index a8cf6de84a..c42fcaea18 100644 --- a/detections/network/ngrok_reverse_proxy_on_network.yml +++ b/detections/network/ngrok_reverse_proxy_on_network.yml @@ -1,6 +1,6 @@ name: Ngrok Reverse Proxy on Network id: 5790a766-53b8-40d3-a696-3547b978fcf0 -version: 4 +version: 5 date: '2024-11-15' author: Michael Haag, Splunk status: production @@ -17,7 +17,8 @@ data_source: - Sysmon EventID 22 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.query IN ("*.ngrok.com","*.ngrok.io", - "ngrok.*.tunnel.com", "korgn.*.lennut.com") by DNS.src DNS.query DNS.answer | `drop_dm_object_name("DNS")` + "ngrok.*.tunnel.com", "korgn.*.lennut.com") by DNS.answer DNS.answer_count DNS.query + DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ngrok_reverse_proxy_on_network_filter`' how_to_implement: The Network Resolution Datamodel will need to have data mapped to it regarding DNS queries. Modify query as needed to use another source. @@ -64,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/ngrok/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index be2edfc03a..1cb7119d9c 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,6 +1,6 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 5 +version: 6 date: '2024-11-15' author: Rico Valdez, Splunk status: production @@ -13,12 +13,14 @@ description: The following analytic detects instances where network traffic, ide to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. -data_source: [] +data_source: +- Zeek Conn search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.action = allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action - | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port - OUTPUT app is_prohibited note transport | search is_prohibited=true | `security_content_ctime(firstTime)` + All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product | lookup update=true + interesting_ports_lookup dest_port as All_Traffic.dest_port OUTPUT app is_prohibited + note transport | search is_prohibited=true | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter`' how_to_implement: In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed @@ -67,7 +69,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048/ftp_connection/zeek_conn.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048/ftp_connection/zeek_conn.log sourcetype: bro:conn:json source: conn.log diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml index 866c4cc5e4..47727cdb56 100644 --- a/detections/network/remote_desktop_network_traffic.yml +++ b/detections/network/remote_desktop_network_traffic.yml @@ -1,6 +1,6 @@ name: Remote Desktop Network Traffic id: 272b8407-842d-4b3d-bead-a704584003d3 -version: 9 +version: 10 date: '2025-02-10' author: David Dorsey, Splunk status: production @@ -13,11 +13,13 @@ description: The following analytic detects unusual Remote Desktop Protocol (RDP to control networked systems, leading to data theft, ransomware deployment, or further network compromise. If confirmed malicious, this activity could result in significant data breaches or complete system and network control loss. -data_source: [] +data_source: +- Zeek Conn search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source AND All_Traffic.action="allowed" by All_Traffic.src All_Traffic.dest All_Traffic.dest_port + All_Traffic.dest_ip All_Traffic.dvc All_Traffic.src_ip All_Traffic.src_port All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_desktop_network_traffic_filter`' how_to_implement: To successfully implement this search you need to identify systems @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/remote_desktop_connection/zeek_conn.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.001/remote_desktop_connection/zeek_conn.log sourcetype: bro:conn:json source: conn.log diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/network/rundll32_dnsquery.yml similarity index 86% rename from detections/endpoint/rundll32_dnsquery.yml rename to detections/network/rundll32_dnsquery.yml index 398448fbaf..2fac28f717 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/network/rundll32_dnsquery.yml @@ -1,6 +1,6 @@ name: Rundll32 DNSQuery id: f1483f5e-ee29-11eb-9d23-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,9 +16,9 @@ description: The following analytic detects a suspicious `rundll32.exe` process data_source: - Sysmon EventID 22 search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) - as firstTime max(_time) as lastTime values(query) as query values(answer) as answer - values(QueryResults) as query_results values(QueryStatus) as query_status by process_name - process_guid Computer | rename Computer as dest | `security_content_ctime(firstTime)` + as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid + process_name query query_count reply_code_id signature signature_id src user_id + vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. @@ -43,9 +43,9 @@ drilldown_searches: latest_offset: $info_max_time$ rba: message: rundll32 process $process_name$ made a DNS query for $query$ from host - $dest$ + $dvc$ risk_objects: - - field: dest + - field: dvc type: system score: 56 threat_objects: @@ -66,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/network/suspicious_process_dns_query_known_abuse_web_services.yml similarity index 87% rename from detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml rename to detections/network/suspicious_process_dns_query_known_abuse_web_services.yml index d239401dda..b32c10918d 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/network/suspicious_process_dns_query_known_abuse_web_services.yml @@ -1,6 +1,6 @@ name: Suspicious Process DNS Query Known Abuse Web Services id: 3cf0dc36-484d-11ec-a6bc-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -18,8 +18,9 @@ search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*api.te process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe","cscript.exe") OR Image IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*", "*\\perflogs\\*") | stats count min(_time) as firstTime max(_time) - as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | - rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + as lastTime by answer answer_count dvc process_exec process_guid process_name query + query_count reply_code_id signature signature_id src user_id vendor_product QueryName + QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`' how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. @@ -44,9 +45,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious process $process_name$ made a DNS query for $QueryName$ on $dest$ + message: Suspicious process $process_name$ made a DNS query for $QueryName$ on $dvc$ risk_objects: - - field: dest + - field: dvc type: system score: 64 threat_objects: @@ -72,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_pastebin_download/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/network/suspicious_process_with_discord_dns_query.yml similarity index 87% rename from detections/endpoint/suspicious_process_with_discord_dns_query.yml rename to detections/network/suspicious_process_with_discord_dns_query.yml index 4dd954857d..51872b4763 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/network/suspicious_process_with_discord_dns_query.yml @@ -1,6 +1,6 @@ name: Suspicious Process With Discord DNS Query id: 4d4332ae-792c-11ec-89c1-acde48001122 -version: 7 +version: 8 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -16,8 +16,9 @@ data_source: - Sysmon EventID 22 search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) - as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name - QueryResults Computer | rename Computer as dest | `security_content_ctime(firstTime)` + as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid + process_name query query_count reply_code_id signature signature_id src user_id + vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`' how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query. known_false_positives: Noise and false positive can be seen if the following instant @@ -42,9 +43,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: suspicious process $process_name$ has a dns query in $QueryName$ on $dest$ + message: suspicious process $process_name$ has a dns query in $QueryName$ on $dvc$ risk_objects: - - field: dest + - field: dvc type: system score: 64 threat_objects: @@ -66,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/network/tor_traffic.yml b/detections/network/tor_traffic.yml index 4b1d821c41..70f224eeda 100644 --- a/detections/network/tor_traffic.yml +++ b/detections/network/tor_traffic.yml @@ -1,6 +1,6 @@ name: TOR Traffic id: ea688274-9c06-4473-b951-e4cb7a5d7a45 -version: 7 +version: 8 date: '2025-02-10' author: David Dorsey, Bhavin Patel, Splunk status: production @@ -17,9 +17,11 @@ data_source: - Palo Alto Network Traffic search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed - by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` - | `tor_traffic_filter`' + by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out + All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `tor_traffic_filter`' how_to_implement: In order to properly run this search, Splunk needs to ingest data from Next Generation Firewalls like Palo Alto Networks Firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary @@ -68,7 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed.log source: pan_tor_allowed sourcetype: pan:traffic diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/network/wermgr_process_connecting_to_ip_check_web_services.yml similarity index 86% rename from detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml rename to detections/network/wermgr_process_connecting_to_ip_check_web_services.yml index 5a0d5637a2..f9cd823968 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/network/wermgr_process_connecting_to_ip_check_web_services.yml @@ -1,6 +1,6 @@ name: Wermgr Process Connecting To IP Check Web Services id: ed313326-a0f9-11eb-a89c-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production @@ -18,10 +18,10 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") - | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name - ProcessId QueryName QueryStatus QueryResults EventCode Computer | rename Computer - as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `wermgr_process_connecting_to_ip_check_web_services_filter`' + | stats min(_time) as firstTime max(_time) as lastTime count by answer answer_count + dvc process_exec process_guid process_name query query_count reply_code_id signature + signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least @@ -45,9 +45,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Wermgr.exe process connecting IP location web services on $dest$ + message: Wermgr.exe process connecting IP location web services on $dvc$ risk_objects: - - field: dest + - field: dvc type: system score: 56 threat_objects: [] @@ -65,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_abused_web_services.yml b/detections/network/windows_abused_web_services.yml similarity index 87% rename from detections/endpoint/windows_abused_web_services.yml rename to detections/network/windows_abused_web_services.yml index e1658b85c3..c12ba36f87 100644 --- a/detections/endpoint/windows_abused_web_services.yml +++ b/detections/network/windows_abused_web_services.yml @@ -1,6 +1,6 @@ name: Windows Abused Web Services id: 01f0aef4-8591-4daa-a53d-0ed49823b681 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic detects a suspicious process making DNS quer code execution, data exfiltration, or further compromise of the target host. search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*",""*textbin*"", "*ngrok.io*", "*discord*", "*duckdns.org*", "*pasteio.com*") | stats count min(_time) as firstTime - max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults - Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name + query query_count reply_code_id signature signature_id src user_id vendor_product + QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_abused_web_services_filter`' how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days. @@ -41,9 +42,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a network connection on known abused web services from $dest$ + message: a network connection on known abused web services from $dvc$ risk_objects: - - field: dest + - field: dvc type: system score: 36 threat_objects: @@ -64,7 +65,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml similarity index 84% rename from detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml rename to detections/network/windows_dns_query_request_by_telegram_bot_api.yml index 94664fd032..861b808fa1 100644 --- a/detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,6 +1,6 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 2 +version: 3 date: '2025-02-10' author: Teoderick Contreras, Splunk data_source: @@ -16,8 +16,9 @@ description: The following analytic detects the execution of a DNS query by a pr Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network. search: '`sysmon` EventCode=22 query = "api.telegram.org" process_name != "telegram.exe" - | stats count min(_time) as firstTime max(_time) as lastTime by query answer QueryResults - QueryStatus process_name process_guid Computer | rename Computer as dest | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count + dvc process_exec process_guid process_name query query_count reply_code_id signature + signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dns_query_request_by_telegram_bot_api_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. @@ -40,9 +41,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: DNS query by a telegram bot [$query$] on [$dest$]. + message: DNS query by a telegram bot [$query$] on [$dvc$]. risk_objects: - - field: dest + - field: dvc type: system score: 36 threat_objects: [] @@ -61,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml similarity index 85% rename from detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml rename to detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml index ddc18ae497..3cb3a1a986 100644 --- a/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -1,6 +1,6 @@ name: Windows Gather Victim Network Info Through Ip Check Web Services id: 70f7c952-0758-46d6-9148-d8969c4481d1 -version: 9 +version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -19,8 +19,9 @@ search: '`sysmon` EventCode=22 QueryName IN ("*wtfismyip.com", "*checkip.*", "* "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*", "*geoip.*", "*icanhazip.*") | stats min(_time) as firstTime max(_time) as lastTime - count by Image ProcessId QueryName QueryStatus QueryResults EventCode Computer - | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + count by answer answer_count dvc process_exec process_guid process_name query query_count + reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults + QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from @@ -50,7 +51,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml b/detections/network/windows_multi_hop_proxy_tor_website_query.yml similarity index 85% rename from detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml rename to detections/network/windows_multi_hop_proxy_tor_website_query.yml index f223d20020..bc057a8249 100644 --- a/detections/endpoint/windows_multi_hop_proxy_tor_website_query.yml +++ b/detections/network/windows_multi_hop_proxy_tor_website_query.yml @@ -1,6 +1,6 @@ name: Windows Multi hop Proxy TOR Website Query id: 4c2d198b-da58-48d7-ba27-9368732d0054 -version: 5 +version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -16,8 +16,9 @@ description: The following analytic identifies DNS queries to known TOR proxy we data_source: - Sysmon EventID 22 search: '`sysmon` EventCode=22 QueryName IN ("*.torproject.org", "www.theonionrouter.com") - | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName - QueryStatus ProcessId Computer | rename Computer as dest | `security_content_ctime(firstTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count + dvc process_exec process_guid process_name query query_count reply_code_id signature + signature_id src user_id vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_multi_hop_proxy_tor_website_query_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 22 dns query events from your @@ -42,10 +43,10 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: a process $Image$ is having a dns query in a tor domain $QueryName$ in - $dest$ + message: a process $process_name$ is having a dns query in a tor domain $QueryName$ + in $dvc$ risk_objects: - - field: dest + - field: dvc type: system score: 25 threat_objects: [] @@ -63,7 +64,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml b/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml index 38f166c9d9..77092299c8 100644 --- a/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml +++ b/detections/network/windows_remote_desktop_network_bruteforce_attempt.yml @@ -1,23 +1,34 @@ name: Windows Remote Desktop Network Bruteforce Attempt id: 908bf0d5-0983-4afd-b6a4-e9eb5d361a7d -version: 2 +version: 3 date: '2025-02-11' author: Jose Hernandez, Bhavin Patel, Splunk status: production type: Anomaly -description: The following analytic identifies potential Remote Desktop Protocol (RDP) brute force attacks by monitoring network traffic for RDP application activity. This query detects potential RDP brute force attacks by identifying source IPs that have made more than 10 connection attempts to the same RDP port on a host within a one-hour window. The results are presented in a table that includes the source and destination IPs, destination port, number of attempts, and the times of the first and last connection attempts, helping to prioritize IPs based on the intensity of activity. +description: The following analytic identifies potential Remote Desktop Protocol (RDP) + brute force attacks by monitoring network traffic for RDP application activity. + This query detects potential RDP brute force attacks by identifying source IPs that + have made more than 10 connection attempts to the same RDP port on a host within + a one-hour window. The results are presented in a table that includes the source + and destination IPs, destination port, number of attempts, and the times of the + first and last connection attempts, helping to prioritize IPs based on the intensity + of activity. data_source: - Sysmon EventID 3 -search: >- - | tstats `security_content_summariesonly` count, min(_time) as firstTime, max(_time) as lastTime values(Al_Traffic.action) as action from datamodel=Network_Traffic where (All_Traffic.app=rdp OR All_Traffic.dest_port=3389) by All_Traffic.src, All_Traffic.dest, All_Traffic.dest_port All_Traffic.user All_Traffic.vendor_product - | `drop_dm_object_name("All_Traffic")` - | eval duration=lastTime-firstTime - | where count > 10 AND duration < 3600 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_remote_desktop_network_bruteforce_attempt_filter` -how_to_implement: You must ensure that your network traffic data is populating the Network_Traffic data model. Adjust the count and duration thresholds as necessary to tune the sensitivity of your detection. -known_false_positives: RDP gateways may have unusually high amounts of traffic from all other hosts' RDP applications in the network.Any legitimate RDP traffic using wrong/expired credentials will be also detected as a false positive. +search: '| tstats `security_content_summariesonly` count, min(_time) as firstTime, + max(_time) as lastTime values(Al_Traffic.src_port) as src_port from datamodel=Network_Traffic + where (All_Traffic.app=rdp OR All_Traffic.dest_port=3389) by All_Traffic.action + All_Traffic.app All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.direction All_Traffic.dvc + All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.transport + All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` | + eval duration=lastTime-firstTime | where count > 10 AND duration < 3600 | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `windows_remote_desktop_network_bruteforce_attempt_filter`' +how_to_implement: You must ensure that your network traffic data is populating the + Network_Traffic data model. Adjust the count and duration thresholds as necessary + to tune the sensitivity of your detection. +known_false_positives: RDP gateways may have unusually high amounts of traffic from + all other hosts' RDP applications in the network.Any legitimate RDP traffic using + wrong/expired credentials will be also detected as a false positive. references: - https://www.zscaler.com/blogs/security-research/ransomware-delivered-using-rdp-brute-force-attack - https://www.reliaquest.com/blog/rdp-brute-force-attacks/ @@ -27,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml b/detections/network/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml similarity index 79% rename from detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml rename to detections/network/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml index b59cd135c2..5dc0448340 100644 --- a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml +++ b/detections/network/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml @@ -1,6 +1,6 @@ name: Windows Spearphishing Attachment Connect To None MS Office Domain id: 1cb40e15-cffa-45cc-abbd-e35884a49766 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: production @@ -17,9 +17,10 @@ data_source: search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe","*\\onenote.exe", "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe", "*\\msaccess.exe") AND NOT(QueryName IN ("*.office.com", "*.office.net")) | stats count min(_time) - as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus - Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`' + as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid + process_name query query_count reply_code_id signature signature_id src user_id + vendor_product QueryName QueryResults QueryStatus | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -44,7 +45,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 6f186e9379..25aac973dd 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 7 +version: 8 date: '2024-11-15' author: Steven Dick status: production @@ -17,11 +17,11 @@ data_source: search: '| tstats count min(_time) as firstTime max(_time) as lastTime latest(Web.http_method) as http_method latest(Web.http_user_agent) as http_user_agent latest(Web.url) as url latest(Web.user) as user latest(Web.dest) as dest from datamodel=Web by Web.action - Web.src Web.category Web.url_domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name("Web")` | lookup remote_access_software remote_domain AS - url_domain OUTPUT isutility, description as signature, comment_reference as desc, - category | search isutility = True | `remote_access_software_usage_exceptions` | - `detect_remote_access_software_usage_url_filter`' + Web.src Web.category Web.url_domain Web.url_length | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `drop_dm_object_name("Web")` | lookup remote_access_software + remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference + as desc, category | search isutility = True | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_url_filter`' how_to_implement: The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data @@ -52,7 +52,7 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: Investigate traffic to $url_domain$ +- name: Investigate traffic to $url_domain$ search: '| from datamodel:Web | search src=$src$ url_domain=$url_domain$' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -70,7 +70,7 @@ rba: - field: url_domain type: domain - field: signature - type: signature + type: signature tags: analytic_story: - Insider Threat @@ -90,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_palo.log source: screenconnect_palo sourcetype: pan:threat diff --git a/lookups/attacker_tools.csv b/lookups/attacker_tools.csv index 544285222c..c7a5bf78b8 100644 --- a/lookups/attacker_tools.csv +++ b/lookups/attacker_tools.csv @@ -28,4 +28,11 @@ kportscan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking For advanced_port_scanner.exe,Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports. mimikatz.exe,utility Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets. certify.exe,A tool used to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS) -certipy.exe,A tool used to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS) \ No newline at end of file +certipy.exe,A tool used to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS) +ladon.exe,Ladon is a multi-threaded plug-in comprehensive scanning artifact for large-scale network penetration including port scanning service identification network assets password explosion high-risk vulnerability detection and one click getshell. +sharpTask.exe,SharpTask is a tool that allows you to create scheduled tasks on a Windows system. +SharpHide.exe,SharpHide is a tool that allows you to hide a process from the task manager. +SharpStay.exe,SharpStay is a tool that allows you to stay hidden from the task manager. +seatbelt.exe,A tool used to collect detailed information about a system—such as remote access configurations network shares and other security-relevant data on victim machine. +SharpGPOAbuse.exe,SharpGPOAbuse is a tool that allows you to abuse and enumerate GPOs on a Windows system. +fscan.exe,Fscan is a tool used to scan for open ports and services on a network. \ No newline at end of file diff --git a/lookups/attacker_tools.yml b/lookups/attacker_tools.yml index 19fa30b2f3..dfbe78b94e 100644 --- a/lookups/attacker_tools.yml +++ b/lookups/attacker_tools.yml @@ -1,6 +1,6 @@ name: attacker_tools -date: 2024-12-23 -version: 2 +date: 2025-03-18 +version: 3 id: 72620fe1-26cb-4cee-a6ee-8c6127056d81 author: Splunk Threat Research Team lookup_type: csv diff --git a/macros/ransomware_extensions.yml b/macros/ransomware_extensions.yml index fde2314d76..302ef76059 100644 --- a/macros/ransomware_extensions.yml +++ b/macros/ransomware_extensions.yml @@ -1,4 +1,4 @@ -definition: lookup update=true ransomware_extensions_lookup Extensions AS file_name OUTPUT Extensions Name | search Name !=False +definition: lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name | search Name !=False description: This macro limits the output to files that have extensions associated with ransomware name: ransomware_extensions diff --git a/removed/detections/change_default_file_association.yml b/removed/detections/change_default_file_association.yml index 3025b5adeb..5ba6a1c6b8 100644 --- a/removed/detections/change_default_file_association.yml +++ b/removed/detections/change_default_file_association.yml @@ -1,6 +1,6 @@ name: Change Default File Association id: 462d17d8-1f71-11ec-ad07-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Teoderick Contreras, Splunk status: removed @@ -19,9 +19,11 @@ data_source: - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user - Registry.registry_path Registry.registry_key_name Registry.registry_value_name | - `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` + ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.action + Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path + Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `change_default_file_association_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model @@ -75,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/removed/detections/detect_mimikatz_using_loaded_images.yml b/removed/detections/detect_mimikatz_using_loaded_images.yml index 6fbe7ff5e7..3f01166c83 100644 --- a/removed/detections/detect_mimikatz_using_loaded_images.yml +++ b/removed/detections/detect_mimikatz_using_loaded_images.yml @@ -1,6 +1,6 @@ name: Detect Mimikatz Using Loaded Images id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 -version: 4 +version: 5 date: '2025-02-10' author: Patrick Bareiss, Splunk status: removed @@ -10,9 +10,14 @@ description: This search looks for reading loaded Images unique to credential du Event Code. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId) - as ProcessId by dest, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll - ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | `security_content_ctime(firstTime)`| +search: '`sysmon` EventCode=7 ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll + ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by EventID FileVersion + Guid Hashes Image ImageLoaded MD5 Opcode OriginalFileName ProcessGuid ProcessID + ProcessId SHA256 SecurityID Signature SignatureStatus Signed UserID dest loaded_file + loaded_file_path original_file_name process_exec process_guid process_hash process_id + process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mimikatz_using_loaded_images_filter`' how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named @@ -57,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/removed/detections/mshtml_module_load_in_office_product.yml b/removed/detections/mshtml_module_load_in_office_product.yml index 03be60e1c7..55e34221a9 100644 --- a/removed/detections/mshtml_module_load_in_office_product.yml +++ b/removed/detections/mshtml_module_load_in_office_product.yml @@ -1,6 +1,6 @@ name: MSHTML Module Load in Office Product id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 8 +version: 9 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk status: removed @@ -18,8 +18,12 @@ data_source: search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", "msaccess.exe","Graph.exe","winproj.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") - | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, - loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` + | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by EventID + FileVersion Guid Hashes Image ImageLoaded MD5 Opcode OriginalFileName ProcessGuid + ProcessID ProcessId SHA256 SecurityID Signature SignatureStatus Signed UserID dest + loaded_file loaded_file_path original_file_name process_exec process_guid process_hash + process_id process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using @@ -73,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/removed/detections/office_application_drop_executable.yml b/removed/detections/office_application_drop_executable.yml index 6289572cc2..bbea325555 100644 --- a/removed/detections/office_application_drop_executable.yml +++ b/removed/detections/office_application_drop_executable.yml @@ -1,6 +1,6 @@ name: Office Application Drop Executable id: 73ce70c4-146d-11ec-9184-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: removed @@ -15,17 +15,40 @@ description: The following analytic has been deprecated. The following analytic escalation, or persistent access, posing a severe threat to the environment. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |join process_guid, _time - [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | fields _time dest file_create_time file_name file_path process_name process_path - process process_guid] | dedup file_create_time | table dest, process_name, process, - file_create_time, file_name, file_path, process_guid | `office_application_drop_executable_filter`' +search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as + firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | + table action dest original_file_name parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path process process_exec process_guid + process_hash process_id process_integrity_level process_name process_path user user_id + vendor_product file_access_time file_create_time file_hash file_modify_time file_name + file_path file_acl file_size firstTime lastTime | stats values(action) as action + values(dest) as dest values(original_file_name) as original_file_name values(parent_process) + as parent_process values(dest) as dest values(original_file_name) as original_file_name + values(parent_process) as parent_process values(parent_process_exec) as parent_process_exec + values(parent_process_guid) as parent_process_guid values(parent_process_id) as + parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path) + as parent_process_path values(process) as process values(process_exec) as process_exec + values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level) + as process_integrity_level values(process_name) as process_name values(process_path) + as process_path values(user) as user values(user_id) as user_id values(vendor_product) + as vendor_product values(file_access_time) as file_access_time values(file_create_time) + as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time + values(file_name) as file_name values(file_path) as file_path values(file_acl) as + file_acl values(file_size) as file_size by process_guid | where isnotnull(process) + AND isnotnull(file_name) | `office_application_drop_executable_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -78,7 +101,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/removed/detections/office_document_creating_schedule_task.yml b/removed/detections/office_document_creating_schedule_task.yml index 75fbcf448d..953ef8a233 100644 --- a/removed/detections/office_document_creating_schedule_task.yml +++ b/removed/detections/office_document_creating_schedule_task.yml @@ -1,6 +1,6 @@ name: Office Document Creating Schedule Task id: cc8b7b74-9d0f-11eb-8342-acde48001122 -version: 11 +version: 12 date: '2025-02-10' author: Teoderick Contreras, Splunk status: removed @@ -16,10 +16,13 @@ description: The following analytic has been deprecated. The following analytic data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe") loaded_file_path = "*\\taskschd.dll" | stats min(_time) as firstTime - max(_time) as lastTime count by user_id, dest, process_name,loaded_file, loaded_file_path, - original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `office_document_creating_schedule_task_filter`' + "msaccess.exe") loaded_file_path = "*\\taskschd.dll" | fillnull | stats count min(_time) + as firstTime max(_time) as lastTime by EventID FileVersion Guid Hashes Image ImageLoaded + MD5 Opcode OriginalFileName ProcessGuid ProcessID ProcessId SHA256 SecurityID Signature + SignatureStatus Signed UserID dest loaded_file loaded_file_path original_file_name + process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists + service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -68,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/removed/detections/office_document_executing_macro_code.yml b/removed/detections/office_document_executing_macro_code.yml index 503de3d2b6..964f8cfd87 100644 --- a/removed/detections/office_document_executing_macro_code.yml +++ b/removed/detections/office_document_executing_macro_code.yml @@ -1,6 +1,6 @@ name: Office Document Executing Macro Code id: b12c89bc-9d06-11eb-a592-acde48001122 -version: 10 +version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk status: removed @@ -15,10 +15,14 @@ description: The following analytic has been deprecated. The following analytic data_source: - Sysmon EventID 7 search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - loaded_file_path IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) - as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by - dest EventCode process_name process_guid | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' + loaded_file_path IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime by EventID FileVersion + Guid Hashes Image ImageLoaded MD5 Opcode OriginalFileName ProcessGuid ProcessID + ProcessId SHA256 SecurityID Signature SignatureStatus Signed UserID dest loaded_file + loaded_file_path original_file_name process_exec process_guid process_hash process_id + process_name process_path service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -78,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/removed/detections/suspicious_file_write.yml b/removed/detections/suspicious_file_write.yml index 12e9533132..92a7a23c9c 100644 --- a/removed/detections/suspicious_file_write.yml +++ b/removed/detections/suspicious_file_write.yml @@ -1,6 +1,6 @@ name: Suspicious File Write id: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 -version: 6 +version: 7 date: '2024-11-14' author: Rico Valdez, Splunk status: removed @@ -11,7 +11,10 @@ data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest + as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `suspicious_writes` | `suspicious_file_write_filter`' how_to_implement: You must be ingesting data that records the filesystem activity diff --git a/removed/detections/unsigned_image_loaded_by_lsass.yml b/removed/detections/unsigned_image_loaded_by_lsass.yml index bda913376f..256b4bb6f9 100644 --- a/removed/detections/unsigned_image_loaded_by_lsass.yml +++ b/removed/detections/unsigned_image_loaded_by_lsass.yml @@ -1,6 +1,6 @@ name: Unsigned Image Loaded by LSASS id: 56ef054c-76ef-45f9-af4a-a634695dcd65 -version: 4 +version: 5 date: '2024-11-14' author: Patrick Bareiss, Splunk status: removed @@ -9,9 +9,14 @@ description: This search detects loading of unsigned images by LSASS. Deprecated too noisy. data_source: - Sysmon EventID 7 -search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time) - as firstTime max(_time) as lastTime by dest, Image, ImageLoaded, Signed, SHA1 | - `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `unsigned_image_loaded_by_lsass_filter`' +search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | fillnull | stats count + min(_time) as firstTime max(_time) as lastTime by EventID FileVersion Guid Hashes + Image ImageLoaded MD5 Opcode OriginalFileName ProcessGuid ProcessID ProcessId SHA256 + SecurityID Signature SignatureStatus Signed UserID dest loaded_file loaded_file_path + original_file_name process_exec process_guid process_hash process_id process_name + process_path service_dll_signature_exists service_dll_signature_verified signature + signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `unsigned_image_loaded_by_lsass_filter`' how_to_implement: This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations diff --git a/removed/detections/windows_hosts_file_modification.yml b/removed/detections/windows_hosts_file_modification.yml index 7f40e5ea32..08f2527601 100644 --- a/removed/detections/windows_hosts_file_modification.yml +++ b/removed/detections/windows_hosts_file_modification.yml @@ -1,6 +1,6 @@ name: Windows hosts file modification id: 06a6fc63-a72d-41dc-8736-7e3dd9612116 -version: 4 +version: 5 date: '2024-11-14' author: Rico Valdez, Splunk status: removed @@ -10,10 +10,13 @@ description: The search looks for modifications to the hosts file on all Windows data_source: - Sysmon EventID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.file_path - Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | search Filesystem.file_name=hosts AND Filesystem.file_path=*Windows\\System32\\* - | `drop_dm_object_name(Filesystem)` | `windows_hosts_file_modification_filter`' + as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | search + Filesystem.file_name=hosts AND Filesystem.file_path=*Windows\\System32\\* | `drop_dm_object_name(Filesystem)` + | `windows_hosts_file_modification_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response diff --git a/stories/php_cgi_rce_attack_on_japanese_organizations.yml b/stories/php_cgi_rce_attack_on_japanese_organizations.yml new file mode 100644 index 0000000000..12c3c02d5f --- /dev/null +++ b/stories/php_cgi_rce_attack_on_japanese_organizations.yml @@ -0,0 +1,29 @@ +name: PHP-CGI RCE Attack on Japanese Organizations +id: e347c55f-439b-4758-8e08-9e2a37a806bc +version: 1 +status: production +date: '2025-03-17' +author: Michael Haag, Splunk +description: This analytic story covers attacks exploiting CVE-2024-4577, a remote code execution (RCE) vulnerability in the PHP-CGI implementation on Windows. Attackers leverage this vulnerability to gain initial access, deploy Cobalt Strike using the "TaoWu" kit for post-exploitation activities, and establish persistence. The attacks primarily target organizations across various sectors including technology, telecommunications, entertainment, education, and e-commerce. +narrative: The attack begins with the exploitation of CVE-2024-4577, a critical RCE vulnerability in Windows-based PHP installations using CGI configurations. The vulnerability arises from the "Best-Fit" behavior in Windows code pages, where certain characters are replaced in command-line inputs, causing the PHP-CGI module to misinterpret these characters as PHP options and allowing arbitrary code execution. + + After identifying vulnerable targets, attackers use a Python exploit script to send specially crafted POST requests containing PHP code. Upon successful exploitation, a PowerShell download cradle retrieves and executes a PowerShell injector script from a command and control (C2) server, which deploys Cobalt Strike reverse HTTP shellcode. + + Post-exploitation activities include reconnaissance (gathering system information), privilege escalation (using JuicyPotato, RottenPotato, SweetPotato exploits), persistence (modifying registry keys, creating scheduled tasks, and Windows services), defense evasion (clearing event logs), lateral movement (network scanning and abusing Group Policy Objects), and credential theft (using Mimikatz). + + The attackers utilize the "TaoWu" Cobalt Strike kit for many of these actions and have access to additional adversarial frameworks hosted on an Alibaba cloud container Registry, including Blue-Lotus (JavaScript webshell XSS framework), BeEF (Browser Exploitation Framework), and Viper C2. + + Detection opportunities include monitoring for suspicious PowerShell download cradles, unusual process spawning patterns, registry modifications for persistence, scheduled task creation, Windows service creation, event log clearing, and network scanning activities. +references: +- https://blog.talosintelligence.com/new-persistent-attacks-japan/ +- https://github.com/watchtowrlabs/CVE-2024-4577/blob/main/watchTowr-vs-php_cve-2024-4577.py +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: + - CVE-2024-4577