diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 74d4aeab10..6eaf1a1025 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,7 +18,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2437aea9fe..9cbfcabf7c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,7 +19,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.2 + echo "CONTENTCTL_VERSION is ${{ vars.CONTENTCTL_VERSION }}" + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 4de315ba24..7efa46679f 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,7 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork diff --git a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml index 3a8db22f36..6c3e89a2d9 100644 --- a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml +++ b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the diff --git a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml index 91be9465f9..fc25a264eb 100644 --- a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml +++ b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-07' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model diff --git a/baselines/baseline_of_cloud_instances_destroyed.yml b/baselines/baseline_of_cloud_instances_destroyed.yml index b8df805a56..7c5bf16935 100644 --- a/baselines/baseline_of_cloud_instances_destroyed.yml +++ b/baselines/baseline_of_cloud_instances_destroyed.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-25' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. diff --git a/baselines/baseline_of_cloud_instances_launched.yml b/baselines/baseline_of_cloud_instances_launched.yml index 3555b055c2..ef6e0e51b8 100644 --- a/baselines/baseline_of_cloud_instances_launched.yml +++ b/baselines/baseline_of_cloud_instances_launched.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-14' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The diff --git a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml index e1bef841f4..f9ba8051dc 100644 --- a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml +++ b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-07' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt diff --git a/baselines/baseline_of_command_line_length___mltk.yml b/baselines/baseline_of_command_line_length___mltk.yml index 1fbadefc68..8746b93a71 100644 --- a/baselines/baseline_of_command_line_length___mltk.yml +++ b/baselines/baseline_of_command_line_length___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-05-08' author: Rico Valdez, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model diff --git a/baselines/baseline_of_dns_query_length___mltk.yml b/baselines/baseline_of_dns_query_length___mltk.yml index 7b326473e9..e638540f4f 100644 --- a/baselines/baseline_of_dns_query_length___mltk.yml +++ b/baselines/baseline_of_dns_query_length___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-05-08' author: Rico Valdez, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build diff --git a/baselines/baseline_of_kubernetes_container_network_io.yml b/baselines/baseline_of_kubernetes_container_network_io.yml index 74505f05a9..63ecf5e914 100644 --- a/baselines/baseline_of_kubernetes_container_network_io.yml +++ b/baselines/baseline_of_kubernetes_container_network_io.yml @@ -4,6 +4,7 @@ version: 4 date: '2024-09-24' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average and standard deviation of inbound and outbound network IO for each Kubernetes container. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates diff --git a/baselines/baseline_of_kubernetes_container_network_io_ratio.yml b/baselines/baseline_of_kubernetes_container_network_io_ratio.yml index 135f36eb3e..05799ca815 100644 --- a/baselines/baseline_of_kubernetes_container_network_io_ratio.yml +++ b/baselines/baseline_of_kubernetes_container_network_io_ratio.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average ratio of inbound to outbound network IO for each Kubernetes container. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates a lookup table diff --git a/baselines/baseline_of_kubernetes_process_resource.yml b/baselines/baseline_of_kubernetes_process_resource.yml index 5fff3368d3..cb7c999811 100644 --- a/baselines/baseline_of_kubernetes_process_resource.yml +++ b/baselines/baseline_of_kubernetes_process_resource.yml @@ -4,6 +4,7 @@ version: 1 date: '2023-12-18' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average and standard deviation of various process resources in a Kubernetes environment. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates a lookup diff --git a/baselines/baseline_of_kubernetes_process_resource_ratio.yml b/baselines/baseline_of_kubernetes_process_resource_ratio.yml index b767c26d4c..a92b872bd1 100644 --- a/baselines/baseline_of_kubernetes_process_resource_ratio.yml +++ b/baselines/baseline_of_kubernetes_process_resource_ratio.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average and standard deviation of the ratio of various process resources in a Kubernetes environment. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule diff --git a/baselines/baseline_of_network_acl_activity_by_arn.yml b/baselines/baseline_of_network_acl_activity_by_arn.yml index b6d39532c0..e56f565690 100644 --- a/baselines/baseline_of_network_acl_activity_by_arn.yml +++ b/baselines/baseline_of_network_acl_activity_by_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-05-21' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then diff --git a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml index 4ae9abb798..a8661c3264 100644 --- a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml +++ b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-07-17' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted diff --git a/baselines/baseline_of_security_group_activity_by_arn.yml b/baselines/baseline_of_security_group_activity_by_arn.yml index cd9a7837f5..c5a8812fba 100644 --- a/baselines/baseline_of_security_group_activity_by_arn.yml +++ b/baselines/baseline_of_security_group_activity_by_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-17' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted diff --git a/baselines/baseline_of_smb_traffic___mltk.yml b/baselines/baseline_of_smb_traffic___mltk.yml index 88765d150a..7dfa90cf4b 100644 --- a/baselines/baseline_of_smb_traffic___mltk.yml +++ b/baselines/baseline_of_smb_traffic___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-05-08' author: Rico Valdez, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The diff --git a/baselines/count_of_assets_by_category.yml b/baselines/count_of_assets_by_category.yml index edd45150fe..7824f09bb9 100644 --- a/baselines/count_of_assets_by_category.yml +++ b/baselines/count_of_assets_by_category.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search shows you every asset category you have and the assets that belong to those categories. search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host) diff --git a/baselines/count_of_unique_ips_connecting_to_ports.yml b/baselines/count_of_unique_ips_connecting_to_ports.yml index cee44026b8..f11befde8a 100644 --- a/baselines/count_of_unique_ips_connecting_to_ports.yml +++ b/baselines/count_of_unique_ips_connecting_to_ports.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-13' author: David Dorsey, Splunk type: Baseline +status: production description: The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts diff --git a/baselines/create_a_list_of_approved_aws_service_accounts.yml b/baselines/create_a_list_of_approved_aws_service_accounts.yml index 2070b5f700..f8b46ac7ff 100644 --- a/baselines/create_a_list_of_approved_aws_service_accounts.yml +++ b/baselines/create_a_list_of_approved_aws_service_accounts.yml @@ -4,6 +4,7 @@ version: 2 date: '2018-12-03' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml index 2364121ba3..607a5f9829 100644 --- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. diff --git a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml index 2b4bb26ab1..461b657a67 100644 --- a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml +++ b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-09' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index 96be5c56e5..ade1932593 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index 080da29767..a6d890da08 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search diff --git a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index e347df4a88..71a860c70b 100644 --- a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-16' author: Bhavin Patel, Splunk type: Baseline +status: deprecated description: This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user diff --git a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml index c468db240d..b0c5e90290 100644 --- a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml +++ b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. diff --git a/baselines/deprecated/previously_seen_ec2_amis.yml b/baselines/deprecated/previously_seen_ec2_amis.yml index be58902ef0..1550cdf588 100644 --- a/baselines/deprecated/previously_seen_ec2_amis.yml +++ b/baselines/deprecated/previously_seen_ec2_amis.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of previously seen AMIs used to launch EC2 instances search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId diff --git a/baselines/deprecated/previously_seen_ec2_instance_types.yml b/baselines/deprecated/previously_seen_ec2_instance_types.yml index f6dfa52c5d..cfff4e6d58 100644 --- a/baselines/deprecated/previously_seen_ec2_instance_types.yml +++ b/baselines/deprecated/previously_seen_ec2_instance_types.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of previously seen EC2 instance types search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) diff --git a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml index fac412ebec..d1aa8e8045 100644 --- a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml +++ b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn diff --git a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml index 779198e56c..f8e40480d7 100644 --- a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-30' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 diff --git a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml index e277b9e21f..063ad93dcc 100644 --- a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. diff --git a/baselines/discover_dns_records.yml b/baselines/discover_dns_records.yml index d6e55f2da8..2faf30e568 100644 --- a/baselines/discover_dns_records.yml +++ b/baselines/discover_dns_records.yml @@ -4,6 +4,7 @@ version: 1 date: '2025-01-16' author: Jose Hernandez, Splunk type: Baseline +status: production description: The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution diff --git a/baselines/dnstwist_domain_names.yml b/baselines/dnstwist_domain_names.yml index 2fae219f27..dbfba119f7 100644 --- a/baselines/dnstwist_domain_names.yml +++ b/baselines/dnstwist_domain_names.yml @@ -4,6 +4,7 @@ version: 2 date: '2018-10-08' author: David Dorsey, Splunk type: Baseline +status: production description: This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. diff --git a/baselines/identify_systems_creating_remote_desktop_traffic.yml b/baselines/identify_systems_creating_remote_desktop_traffic.yml index 616b6beb32..f466963093 100644 --- a/baselines/identify_systems_creating_remote_desktop_traffic.yml +++ b/baselines/identify_systems_creating_remote_desktop_traffic.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline +status: production description: This search counts the numbers of times the system has generated remote desktop traffic. search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic diff --git a/baselines/identify_systems_receiving_remote_desktop_traffic.yml b/baselines/identify_systems_receiving_remote_desktop_traffic.yml index e9f2f3148e..19fc44ca03 100644 --- a/baselines/identify_systems_receiving_remote_desktop_traffic.yml +++ b/baselines/identify_systems_receiving_remote_desktop_traffic.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline +status: production description: This search counts the numbers of times the system has created remote desktop traffic search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic diff --git a/baselines/identify_systems_using_remote_desktop.yml b/baselines/identify_systems_using_remote_desktop.yml index 8e315c2ae3..434b290d1f 100644 --- a/baselines/identify_systems_using_remote_desktop.yml +++ b/baselines/identify_systems_using_remote_desktop.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-04-01' author: David Dorsey, Splunk type: Baseline +status: production description: This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes diff --git a/baselines/monitor_successful_backups.yml b/baselines/monitor_successful_backups.yml index c738c4698b..fe0c140a5a 100644 --- a/baselines/monitor_successful_backups.yml +++ b/baselines/monitor_successful_backups.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-12' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/monitor_unsuccessful_backups.yml b/baselines/monitor_unsuccessful_backups.yml index 8834fe6fa1..83195cbae0 100644 --- a/baselines/monitor_unsuccessful_backups.yml +++ b/baselines/monitor_unsuccessful_backups.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-12' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/previously_seen_aws_cross_account_activity.yml b/baselines/previously_seen_aws_cross_account_activity.yml index 47e3777161..ed2cad1585 100644 --- a/baselines/previously_seen_aws_cross_account_activity.yml +++ b/baselines/previously_seen_aws_cross_account_activity.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-04' author: David Dorsey, Splunk type: Baseline +status: production description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_cross_account_activity___initial.yml b/baselines/previously_seen_aws_cross_account_activity___initial.yml index 532f7d9cb3..6fad8d0f18 100644 --- a/baselines/previously_seen_aws_cross_account_activity___initial.yml +++ b/baselines/previously_seen_aws_cross_account_activity___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_cross_account_activity___update.yml b/baselines/previously_seen_aws_cross_account_activity___update.yml index 526e8761f8..9cb9c956b9 100644 --- a/baselines/previously_seen_aws_cross_account_activity___update.yml +++ b/baselines/previously_seen_aws_cross_account_activity___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_regions.yml b/baselines/previously_seen_aws_regions.yml index 5f086d0138..da7bd98582 100644 --- a/baselines/previously_seen_aws_regions.yml +++ b/baselines/previously_seen_aws_regions.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-01-08' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml b/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml index 66917eb309..76a9d53576 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml +++ b/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml b/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml index e49adc7a96..dadd790f96 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml +++ b/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search updates the table of the first and last times seen for every user role and command combination. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml b/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml index 865f24389d..ed6a275c00 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of previously seen users that have launched a cloud compute instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_creations_by_user___update.yml b/baselines/previously_seen_cloud_compute_creations_by_user___update.yml index ca1fe683b6..29d5b5952f 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user___update.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of previously seen users that have launched a cloud compute instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_images___initial.yml b/baselines/previously_seen_cloud_compute_images___initial.yml index eb3b830b1a..963cdf7af0 100644 --- a/baselines/previously_seen_cloud_compute_images___initial.yml +++ b/baselines/previously_seen_cloud_compute_images___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-10-08' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen images used to launch cloud compute instances search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_images___update.yml b/baselines/previously_seen_cloud_compute_images___update.yml index 63773389da..580b2ad13c 100644 --- a/baselines/previously_seen_cloud_compute_images___update.yml +++ b/baselines/previously_seen_cloud_compute_images___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-12' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen images used to launch cloud compute instances search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_instance_types___initial.yml b/baselines/previously_seen_cloud_compute_instance_types___initial.yml index 60e2a0386a..1f325d98c9 100644 --- a/baselines/previously_seen_cloud_compute_instance_types___initial.yml +++ b/baselines/previously_seen_cloud_compute_instance_types___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen cloud compute instance types search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_instance_types___update.yml b/baselines/previously_seen_cloud_compute_instance_types___update.yml index cf50524d02..4c426ae70e 100644 --- a/baselines/previously_seen_cloud_compute_instance_types___update.yml +++ b/baselines/previously_seen_cloud_compute_instance_types___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen cloud compute instance types search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml b/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml index dc993e3fb5..4685a5d45e 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml +++ b/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-07-29' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of previously seen users that have modified a cloud instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml b/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml index b89c7d40bf..68d81025a8 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml +++ b/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-07-29' author: Rico Valdez, Splunk type: Baseline +status: production description: This search updates a table of previously seen Cloud Instance modifications that have been made by a user search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml b/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml index e5a85d2ea8..0296b5697c 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml +++ b/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-19' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml b/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml index b7b4696662..6997f09948 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml +++ b/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-20' author: David Dorsey, Splunk type: Baseline +status: production description: This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs diff --git a/baselines/previously_seen_cloud_regions___initial.yml b/baselines/previously_seen_cloud_regions___initial.yml index 2af26937ff..68a9aaac84 100644 --- a/baselines/previously_seen_cloud_regions___initial.yml +++ b/baselines/previously_seen_cloud_regions___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-02' author: David Dorsey, Splunk type: Baseline +status: production description: This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the diff --git a/baselines/previously_seen_cloud_regions___update.yml b/baselines/previously_seen_cloud_regions___update.yml index 6bd55881bb..fe6e4e31a4 100644 --- a/baselines/previously_seen_cloud_regions___update.yml +++ b/baselines/previously_seen_cloud_regions___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-02' author: David Dorsey, Splunk type: Baseline +status: production description: This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the diff --git a/baselines/previously_seen_command_line_arguments.yml b/baselines/previously_seen_command_line_arguments.yml index 223e790d2b..f797569828 100644 --- a/baselines/previously_seen_command_line_arguments.yml +++ b/baselines/previously_seen_command_line_arguments.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-03-01' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. diff --git a/baselines/previously_seen_ec2_modifications_by_user.yml b/baselines/previously_seen_ec2_modifications_by_user.yml index 8c1d9a7dd8..fdf51c1460 100644 --- a/baselines/previously_seen_ec2_modifications_by_user.yml +++ b/baselines/previously_seen_ec2_modifications_by_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-05' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn diff --git a/baselines/previously_seen_running_windows_services___initial.yml b/baselines/previously_seen_running_windows_services___initial.yml index 3bd5dd8724..429efbceae 100644 --- a/baselines/previously_seen_running_windows_services___initial.yml +++ b/baselines/previously_seen_running_windows_services___initial.yml @@ -4,6 +4,7 @@ version: 3 date: '2020-06-23' author: David Dorsey, Splunk type: Baseline +status: production description: This collects the services that have been started across your entire enterprise. search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) diff --git a/baselines/previously_seen_running_windows_services___update.yml b/baselines/previously_seen_running_windows_services___update.yml index cb43f77348..e5ef21ba42 100644 --- a/baselines/previously_seen_running_windows_services___update.yml +++ b/baselines/previously_seen_running_windows_services___update.yml @@ -4,6 +4,7 @@ version: 3 date: '2020-06-23' author: David Dorsey, Splunk type: Baseline +status: production description: This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within diff --git a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml b/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml index 35b04b57b8..ed80570f70 100644 --- a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml +++ b/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-28' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking diff --git a/baselines/previously_seen_users_in_cloudtrail___initial.yml b/baselines/previously_seen_users_in_cloudtrail___initial.yml index c4993b029c..39b4d4f14c 100644 --- a/baselines/previously_seen_users_in_cloudtrail___initial.yml +++ b/baselines/previously_seen_users_in_cloudtrail___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-28' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last diff --git a/baselines/previously_seen_users_in_cloudtrail___update.yml b/baselines/previously_seen_users_in_cloudtrail___update.yml index b2e2ffe0f8..06983af330 100644 --- a/baselines/previously_seen_users_in_cloudtrail___update.yml +++ b/baselines/previously_seen_users_in_cloudtrail___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-28' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. diff --git a/baselines/previously_seen_zoom_child_processes___initial.yml b/baselines/previously_seen_zoom_child_processes___initial.yml index a5ea66b367..812ab81ab0 100644 --- a/baselines/previously_seen_zoom_child_processes___initial.yml +++ b/baselines/previously_seen_zoom_child_processes___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-20' author: David Dorsey, Splunk type: Baseline +status: production description: This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. diff --git a/baselines/previously_seen_zoom_child_processes___update.yml b/baselines/previously_seen_zoom_child_processes___update.yml index 69a8b515ae..350131e49a 100644 --- a/baselines/previously_seen_zoom_child_processes___update.yml +++ b/baselines/previously_seen_zoom_child_processes___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-20' author: David Dorsey, Splunk type: Baseline +status: production description: This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name diff --git a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml b/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml index 5326bc7c88..7b26e9e44d 100644 --- a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml +++ b/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-01-08' author: David Dorsey, Splunk type: Baseline +status: production description: Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this diff --git a/baselines/windows_updates_install_failures.yml b/baselines/windows_updates_install_failures.yml index 9eab1ba798..d9bd881691 100644 --- a/baselines/windows_updates_install_failures.yml +++ b/baselines/windows_updates_install_failures.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. diff --git a/baselines/windows_updates_install_successes.yml b/baselines/windows_updates_install_successes.yml index 9f460357c8..cac97fe4e8 100644 --- a/baselines/windows_updates_install_successes.yml +++ b/baselines/windows_updates_install_successes.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. diff --git a/contentctl.yml b/contentctl.yml index 1608f85298..1bd5b72e03 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 4.44.0 + version: 5.0.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU @@ -155,9 +155,9 @@ apps: - uid: 3110 title: Splunk Add-on for Microsoft Cloud Services appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES - version: 5.4.1 + version: 5.4.2 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz - uid: 4055 title: Splunk Add-on for Microsoft Office 365 appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365 diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 5acf9c76b5..2fa460b33f 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -10,4 +10,4 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 9db213655d..f527bda794 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index c62d91a8c2..3a0db1013e 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 6e3b00d39a..a58de4a47b 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 798a1dd0c9..e3970586a3 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 2cb8e93738..d4103cfef6 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 9464b69c7a..d7a04aa5ad 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 2b1fd79f79..2ef98d1f69 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 710007e9f8..b09a4f4204 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index ebb0a4dea9..e66920d152 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 1247baa3b5..b3fb17cd5e 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 07fbd4945f..dda3730b7f 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 71e28dc986..7b53354989 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 821d432ecf..b77b1dfa80 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 6d43b471e6..d04c125346 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 4efa2a3816..c589966ec2 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index f7bef825fe..5880ca36cd 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 8e30686b23..b341d24461 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 024427c038..6511f9fe3e 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 35fccd817e..da046c0e0b 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 4a4eb3f0b0..d3526f723c 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -3,14 +3,17 @@ id: 1997a515-a61a-4f78-ada9-54af34c764f2 version: 1 date: '2025-01-13' author: Bhavin Patel, Splunk -description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. +description: Data source object for Azure Monitor Activity. The Splunk Add-on for + Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure + EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic + settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD sourcetype: azure:monitor:activity separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - column - action @@ -93,4 +96,16 @@ fields: - vendor_product - vendor_region - _time -example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}' +example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", + "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", + "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, + "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", + "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, + "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": + "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, + "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", + "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": + ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": + "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, + "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", + "identity": "brian.cove@frothlydev.onmicrosoft.com"}' diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index cd08575aa2..468d387446 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -6,7 +6,10 @@ author: Patrick Bareiss, Splunk description: Data source object for Linux Secure source: /var/log/secure sourcetype: linux_secure -supported_TA: [] +supported_TA: +- name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 9.2.0 fields: - _time - action diff --git a/detections/application/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml index 68b4b36694..e75c27439a 100644 --- a/detections/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/application/email_attachments_with_lots_of_spaces.yml @@ -29,7 +29,7 @@ how_to_implement: "You need to ingest data from emails. Specifically, the sender this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the \"\ Phantom Instance\" field in the Adaptive Response Actions when configuring this - detection search. The notable event will be sent to Phantom and the playbook will + detection search. The finding based event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox." diff --git a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml index d305ab358d..5b2d38b889 100644 --- a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml +++ b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml @@ -60,9 +60,9 @@ references: - https://splunkbase.splunk.com/app/6553 rba: message: A mismatch between source and response for verifying a push request has - occurred for $actor.alternateId$ + occurred for $user$ risk_objects: - - field: actor.alternateId + - field: user type: user score: 64 threat_objects: [] diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index 5e36be6c59..f96b59ed7a 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -28,9 +28,9 @@ search: '| tstats `security_content_summariesonly` values(All_Risk.analyticstori | search mitre_technique_id_count > 5 | `okta_risk_threshold_exceeded_filter`' how_to_implement: This search leverages the Risk Framework from Enterprise Security. Ensure that "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion" - analytic stories are enabled. TTPs may be set to Notables for point detections; - anomalies should not be notables but rather risk generators. The correlation relies - on risk before generating a notable. Modify the value as needed. + analytic stories are enabled. TTPs may be set to finding for point detections; + anomalies should not be findings but rather intermediate findings. The correlation relies + on intermediate findings before generating a findings. Modify the value as needed. known_false_positives: False positives will be limited to the number of events generated by the analytics tied to the stories. Analytics will need to be tested and tuned, and the risk score reduced as needed based on the organization. diff --git a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml index 021ec93c2e..17e059d927 100644 --- a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml +++ b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml @@ -1,6 +1,6 @@ name: PingID Mismatch Auth Source and Verification Response id: 15b0694e-caa2-4009-8d83-a1f98b86d086 -version: 4 +version: 5 date: '2025-01-21' author: Steven Dick status: production diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index 0f01351ca0..3a44f76bfa 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -26,7 +26,7 @@ how_to_implement: "You need to ingest data from emails. Specifically, the sender Delete\" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response - Actions when configuring this detection search. The notable event will be sent to + Actions when configuring this detection search. The finding event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox.'" diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index df005bfae6..01c2dd31bc 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Suspicious Attribute Modification id: 5682052e-ce55-4f9f-8d28-59191420b7e0 -version: 3 +version: 4 date: '2025-01-21' author: Dean Luxton status: production diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index 976ed7ea7d..00ca4b7616 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Suspicious GPO Modification id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf -version: 3 +version: 4 date: '2025-01-21' author: Dean Luxton status: experimental diff --git a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml index f619aec6a7..28a9d9a628 100644 --- a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml @@ -8,7 +8,8 @@ type: TTP description: The following analytic detects `StopLogging` events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. By halting the logging of their malicious activities, attackers aim to operate undetected within a compromised AWS environment. This detection is achieved by monitoring for specific CloudTrail log entries that indicate the cessation of logging activities. Identifying such behavior is crucial for a Security Operations Center (SOC), as it signals an attempt to undermine the integrity of logging mechanisms, potentially allowing malicious activities to proceed without observation. The impact of this evasion tactic is significant, as it can severely hamper incident response and forensic investigations by obscuring the attacker's actions. data_source: - ASL AWS CloudTrail -search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`' +search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account.uid + as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity. references: diff --git a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml index 70e9142d20..1b45a81b7f 100644 --- a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml @@ -8,7 +8,7 @@ type: TTP description: The following analytic detects `UpdateTrail` events within AWS CloudTrail logs, aiming to identify attempts by attackers to evade detection by altering logging configurations. By updating CloudTrail settings with incorrect parameters, such as changing multi-regional logging to a single region, attackers can impair the logging of their activities across other regions. This behavior is crucial for Security Operations Centers (SOCs) to identify, as it indicates an adversary's intent to operate undetected within a compromised AWS environment. The impact of such evasion tactics is significant, potentially allowing malicious activities to proceed without being logged, thereby hindering incident response and forensic investigations. data_source: - ASL AWS CloudTrail -search: '`amazon_security_lake` api.operation=UpdateTrail | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_update_cloudtrail_filter`' +search: '`amazon_security_lake` api.operation=UpdateTrail | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account.uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_update_cloudtrail_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity. references: diff --git a/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml index d6bef2c61e..7d42dfa04e 100644 --- a/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml @@ -16,8 +16,8 @@ search: '`amazon_security_lake` api.operation=CreateNetworkAclEntry OR api.opera | spath input=api.request.data path=networkAclId output=networkAclId | search ruleAction=allow AND egress=false AND aclProtocol=-1 AND cidrBlock=0.0.0.0/0 | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region networkAclId - | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id + | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region networkAclId cidrBlock + | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account.uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_network_access_control_list_created_with_all_open_ports_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. known_false_positives: It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. @@ -32,7 +32,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ + message: User $user$ has created network ACLs with all the ports opens to $cidrBlock$ risk_objects: - field: user type: user diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml index 33eb6d2a8d..33305b12f6 100644 --- a/detections/cloud/azure_ad_application_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml @@ -1,6 +1,6 @@ name: Azure AD Application Administrator Role Assigned id: eac4de87-7a56-4538-a21b-277897af6d8d -version: 6 +version: 7 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index 70c74ac118..0ccbb9b85a 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -34,7 +34,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro known_false_positives: "False positives have been minimized by removing attempts that result in 'MFA successfully completed messages', which were found to be generated when a user opts to use a different MFA method than the default.\nFurther reductions - in notable events can be achieved through filtering 'MFA denied; duplicate authentication + in finding events can be achieved through filtering 'MFA denied; duplicate authentication attempt' messages within the auth_msg field, as they could arguably be considered as false positives." references: diff --git a/detections/cloud/azure_ad_azurehound_useragent_detected.yml b/detections/cloud/azure_ad_azurehound_useragent_detected.yml index 12b044f4c3..b81c81b399 100644 --- a/detections/cloud/azure_ad_azurehound_useragent_detected.yml +++ b/detections/cloud/azure_ad_azurehound_useragent_detected.yml @@ -1,6 +1,6 @@ name: Azure AD AzureHound UserAgent Detected id: d62852db-a1f1-40db-a7fc-c3d56fa8bda3 -version: 1 +version: 2 date: '2025-01-06' author: Dean Luxton data_source: diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml index 0a30335c00..b21df736a9 100644 --- a/detections/cloud/azure_ad_external_guest_user_invited.yml +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -1,6 +1,6 @@ name: Azure AD External Guest User Invited id: c1fb4edb-cab1-4359-9b40-925ffd797fb5 -version: 5 +version: 6 date: '2024-11-14' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index 9ede5d603b..7e8ff92cd0 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -1,6 +1,6 @@ name: Azure AD Multi-Factor Authentication Disabled id: 482dd42a-acfa-486b-a0bb-d6fcda27318e -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index e08cfb1eea..1bdea42857 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,6 +1,6 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 6 +version: 7 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_service_principal_enumeration.yml b/detections/cloud/azure_ad_service_principal_enumeration.yml index 0b2628a773..67efb06d67 100644 --- a/detections/cloud/azure_ad_service_principal_enumeration.yml +++ b/detections/cloud/azure_ad_service_principal_enumeration.yml @@ -1,20 +1,20 @@ name: Azure AD Service Principal Enumeration id: 3f0647ce-add5-4436-8039-cbd1abe74563 -version: 1 +version: 2 date: '2025-01-06' author: Dean Luxton data_source: - Azure Active Directory MicrosoftGraphActivityLogs type: TTP -status: production +status: production description: >- This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals. This type of behaviour is associated with tools such as Azure enumberation tools such as AzureHound or ROADtools. search: >- - `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals) + `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals) | fillnull | rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/beta\/servicePrincipals\/(?P.*?)\/" | rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/v1.0\/servicePrincipals\/(?P.*?)\/" - | eval spn=coalesce(servicePrincipalb,servicePrincipalv1) | stats min(_time) as _time dc(spn) as spn_count values(user) as user values(user_category) as user_category values(src_category) as src_category count by src tenantId properties.userAgent + | eval spn=coalesce(servicePrincipalb,servicePrincipalv1) | stats count min(_time) as _time dc(spn) as spn_count values(user_id) as user_id by src tenantId properties.userAgent | rename properties.userAgent as user_agent | where spn_count>9 | `azure_ad_service_principal_enumeration_filter` how_to_implement: >- @@ -27,16 +27,16 @@ references: - https://splunkbase.splunk.com/app/3110 - https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install drilldown_searches: -- name: View the detection results for - "$user$" - search: '%original_detection_search% | search user = "$user$"' +- name: View the detection results for - "$user_id$" + search: '%original_detection_search% | search user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$user_id$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: $spn_count$ Service Principals have been enumerated by $user$ from IP $src$ + message: $spn_count$ Service Principals have been enumerated by $user_id$ from IP $src$ risk_objects: - field: tenantId type: other diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml index 652d5977ff..70759d0bbc 100644 --- a/detections/cloud/azure_ad_service_principal_owner_added.yml +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -1,6 +1,6 @@ name: Azure AD Service Principal Owner Added id: 7ddf2084-6cf3-4a44-be83-474f7b73c701 -version: 7 +version: 8 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index 5cd6090c48..f3601f5b68 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -1,6 +1,6 @@ name: Azure AD User Enabled And Password Reset id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268 -version: 6 +version: 7 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml index 597d44032d..bb46d01420 100644 --- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -1,6 +1,6 @@ name: Azure AD User ImmutableId Attribute Updated id: 0c0badad-4536-4a84-a561-5ff760f3c00e -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml index dc6b0479ea..411d36c82b 100644 --- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml +++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml @@ -1,6 +1,6 @@ name: GCP Multi-Factor Authentication Disabled id: b9bc5513-6fc1-4821-85a3-e1d81e451c83 -version: 5 +version: 6 date: '2024-11-14' author: Bhavin Patel, Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 469c97577b..cda144c5d9 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -1,6 +1,6 @@ name: Gsuite Drive Share In External Email id: f6ee02d6-fea0-11eb-b2c2-acde48001122 -version: 4 +version: 5 date: '2024-11-14' author: Teoderick Contreras, Splunk status: experimental diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 311f449b7f..1081e01e57 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -1,6 +1,6 @@ name: Gsuite Suspicious Shared File Name id: 07eed200-03f5-11ec-98fb-acde48001122 -version: 4 +version: 5 date: '2024-11-14' author: Teoderick Contreras, Splunk status: production diff --git a/detections/cloud/o365_service_principal_new_client_credentials.yml b/detections/cloud/o365_service_principal_new_client_credentials.yml index 702f8ee8f9..4748ee38f9 100644 --- a/detections/cloud/o365_service_principal_new_client_credentials.yml +++ b/detections/cloud/o365_service_principal_new_client_credentials.yml @@ -1,6 +1,6 @@ name: O365 Service Principal New Client Credentials id: a1b229e9-d962-4222-8c62-905a8a010453 -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/deprecated/account_discovery_with_net_app.yml similarity index 82% rename from detections/endpoint/account_discovery_with_net_app.yml rename to detections/deprecated/account_discovery_with_net_app.yml index 701fa8a6f1..ce8d2fa45f 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/deprecated/account_discovery_with_net_app.yml @@ -1,18 +1,11 @@ name: Account Discovery With Net App id: 339805ce-ac30-11eb-b87d-acde48001122 version: 8 -date: '2024-11-13' +date: '2025-01-13' author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community -status: production +status: deprecated type: TTP -description: The following analytic detects potential account discovery activities - using the 'net' command, commonly employed by malware like Trickbot for reconnaissance. - It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line - patterns and process relationships. This activity is significant as it often precedes - further malicious actions, such as lateral movement or privilege escalation. If - confirmed malicious, attackers could gain valuable information about user accounts, - enabling them to escalate privileges or move laterally within the network, posing - a significant security risk. +description: The following analytic has been deprecated in favour of the more generic "45e52536-ae42-11eb-b5c6-acde48001122". The following analytic detects potential account discovery activities using the 'net' command, commonly employed by malware like Trickbot for reconnaissance. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line patterns and process relationships. This activity is significant as it often precedes further malicious actions, such as lateral movement or privilege escalation. If confirmed malicious, attackers could gain valuable information about user accounts, enabling them to escalate privileges or move laterally within the network, posing a significant security risk. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/deprecated/attempt_to_stop_security_service.yml similarity index 96% rename from detections/endpoint/attempt_to_stop_security_service.yml rename to detections/deprecated/attempt_to_stop_security_service.yml index d97c43041d..d3307c59bf 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/deprecated/attempt_to_stop_security_service.yml @@ -1,11 +1,12 @@ name: Attempt To Stop Security Service id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 -version: 8 -date: '2024-11-13' +version: 10 +date: '2025-01-24' author: Rico Valdez, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects attempts to stop security-related services +description: The following analytic has been deprecated. + The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" command with the "stop" parameter. This activity is significant because diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml similarity index 95% rename from detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml rename to detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml index 20436f2388..86d2c20c82 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,11 +1,12 @@ name: Attempted Credential Dump From Registry via Reg exe id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 12 -date: '2024-12-10' +version: 13 +date: '2025-01-15' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the execution of reg.exe with parameters +description: The following analytic has been deprecated in favour of "8bbb7d58-b360-11eb-ba21-acde48001122". + The following analytic detects the execution of reg.exe with parameters that export registry keys containing hashed credentials. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving reg.exe or cmd.exe with specific registry paths. This activity is significant diff --git a/detections/endpoint/change_default_file_association.yml b/detections/deprecated/change_default_file_association.yml similarity index 95% rename from detections/endpoint/change_default_file_association.yml rename to detections/deprecated/change_default_file_association.yml index 9b5b14c169..d552a13219 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/deprecated/change_default_file_association.yml @@ -1,11 +1,12 @@ name: Change Default File Association id: 462d17d8-1f71-11ec-ad07-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects suspicious registry modifications that +description: The following analytic has been deprecated. + The following analytic detects suspicious registry modifications that change the default file association to execute a malicious payload. It leverages data from the Endpoint data model, specifically monitoring registry paths under "*\\shell\\open\\command\\*" and "*HKCR\\*". This activity is significant because diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml similarity index 99% rename from detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml rename to detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml index 7eaaa1fb05..2a47831d2c 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml @@ -1,9 +1,9 @@ name: Cmdline Tool Not Executed In CMD Shell id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -version: 6 -date: '2024-11-13' +version: 8 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell, diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/deprecated/create_local_admin_accounts_using_net_exe.yml similarity index 96% rename from detections/endpoint/create_local_admin_accounts_using_net_exe.yml rename to detections/deprecated/create_local_admin_accounts_using_net_exe.yml index febef3b4f9..28560103fa 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/deprecated/create_local_admin_accounts_using_net_exe.yml @@ -1,11 +1,12 @@ name: Create local admin accounts using net exe id: b89919ed-fe5f-492c-b139-151bb162040e -version: 14 -date: '2024-12-10' +version: 16 +date: '2025-01-24' author: Bhavin Patel, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the creation of local administrator accounts +description: The following analytic has been deprecated. + The following analytic detects the creation of local administrator accounts using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes named net.exe or net1.exe with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/deprecated/deleting_of_net_users.yml similarity index 95% rename from detections/endpoint/deleting_of_net_users.yml rename to detections/deprecated/deleting_of_net_users.yml index 10ea2d7392..379264584f 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/deprecated/deleting_of_net_users.yml @@ -1,11 +1,12 @@ name: Deleting Of Net Users id: 1c8c6f66-acce-11eb-aafb-acde48001122 -version: 6 -date: '2024-11-13' +version: 8 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of net.exe or net1.exe command-line +description: The following analytic has been deprecated. + The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/deprecated/detect_critical_alerts_from_security_tools.yml similarity index 50% rename from detections/endpoint/detect_critical_alerts_from_security_tools.yml rename to detections/deprecated/detect_critical_alerts_from_security_tools.yml index d0f931f849..79ba56809d 100644 --- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml +++ b/detections/deprecated/detect_critical_alerts_from_security_tools.yml @@ -1,45 +1,17 @@ name: Detect Critical Alerts from Security Tools id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd version: 2 -date: '2024-11-13' +date: '2025-01-13' author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Bryan Pluta, Splunk -status: production +status: deprecated type: TTP data_source: - Windows Defender Alerts - MS365 Defender Incident Alerts -description: The following analytics is to detect high and critical alerts from endpoint - security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query - aggregates and summarizes critical severity alerts from the Alerts data model, providing - details such as the alert signature, application, description, source, destination, - and timestamps, while applying custom filters and formatting for enhanced analysis - in a SIEM environment.This capability allows security teams to efficiently allocate - resources and maintain a strong security posture, while also supporting compliance - with regulatory requirements by providing a clear record of critical security events. - We tested these detections with logs from Microsoft Defender, however this detection - should work for any security alerts that are ingested into the alerts data model. - **Note** - We are dynamically creating the risk_score field based on the severity - of the alert in the SPL and that supersedes the risk score set in the detection. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) - as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity - values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) - as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as - dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src - Alerts.user Alerts.id Alerts.vendor sourcetype | `drop_dm_object_name("Alerts")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval - risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", - 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`' -how_to_implement: In order to properly run this search, you to ingest alerts data - from other security products such as Crowdstrike, Microsoft Defender, or Carbon - Black using appropriate TAs for that technology. Once ingested, the fields should - be mapped to the Alerts data model. Make sure to apply transformation on the data - if necessary. The risk_score field is used to calculate the risk score for the alerts - and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework - is dynamically created by the detection when this is triggered. These fields need - not be set in the adaptive response actions. -known_false_positives: False positives may vary by endpoint protection tool; monitor - and filter out the alerts that are not relevant to your environment. +description: The following analytic has been deprecated in favour of specific and dedicated product analytics such as "Microsoft Defender ATP Alerts". The following analytic is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src Alerts.user Alerts.id Alerts.vendor sourcetype | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`' +how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. The risk_score field is used to calculate the risk score for the alerts and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework is dynamically created by the detection when this is triggered. These fields need not be set in the adaptive response actions. +known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment. references: - https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/accessing-microsoft-defender-for-cloud-alerts-in-splunk-using/ba-p/938228 - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml similarity index 96% rename from detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml rename to detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml index 9d8205ac10..d0851935d2 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml @@ -1,11 +1,12 @@ name: Detect processes used for System Network Configuration Discovery id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 -version: 6 -date: '2024-11-13' +version: 8 +date: '2025-01-24' author: Bhavin Patel, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies the rapid execution of processes used +description: The following analytic has been deprecated. + The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity is significant as it diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 04e8be45b6..853d302d85 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -19,13 +19,11 @@ how_to_implement: "This search requires you to be ingesting web-traffic logs. Yo which contains a non-exhaustive list of dynamic DNS providers. Consider periodically updating this local lookup file with new domains.\nThis search produces fields (`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed - when a notable event is raised. These fields contribute additional context to the - notable. To see the additional metadata, add the following fields, if not already + when a finding event is raised. These fields contribute additional context to the + finding. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n* **Label:** IsDynamicDNS, **Field:** - isDynDNS\nDetailed documentation on how to create a new field within Incident Review - may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` - Deprecated because duplicate." + isDynDNS\n Deprecated because duplicate." known_false_positives: It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate. references: [] diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/deprecated/detect_webshell_exploit_behavior.yml similarity index 96% rename from detections/endpoint/detect_webshell_exploit_behavior.yml rename to detections/deprecated/detect_webshell_exploit_behavior.yml index 48a4989e23..3b28ad33f1 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/deprecated/detect_webshell_exploit_behavior.yml @@ -1,11 +1,12 @@ name: Detect Webshell Exploit Behavior id: 22597426-6dbd-49bd-bcdc-4ec19857192f -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-01-24' author: Steven Dick -status: production +status: deprecated type: TTP -description: The following analytic identifies the execution of suspicious processes +description: The following analytic has been deprecated. + The following analytic identifies the execution of suspicious processes typically associated with webshell activity on web servers. It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`. This behavior is significant as it may indicate diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/deprecated/disabling_net_user_account.yml similarity index 95% rename from detections/endpoint/disabling_net_user_account.yml rename to detections/deprecated/disabling_net_user_account.yml index 5179a25496..409e89854a 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/deprecated/disabling_net_user_account.yml @@ -1,11 +1,12 @@ name: Disabling Net User Account id: c0325326-acd6-11eb-98c2-acde48001122 -version: 6 -date: '2024-11-13' +version: 8 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of the `net.exe` utility to disable +description: The following analytic has been deprecated. + The following analytic detects the use of the `net.exe` utility to disable a user account via the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate an adversary's attempt to disrupt diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/deprecated/domain_account_discovery_with_net_app.yml similarity index 82% rename from detections/endpoint/domain_account_discovery_with_net_app.yml rename to detections/deprecated/domain_account_discovery_with_net_app.yml index ae6841c195..7299b21596 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/deprecated/domain_account_discovery_with_net_app.yml @@ -1,17 +1,11 @@ name: Domain Account Discovery With Net App id: 98f6a534-04c2-11ec-96b2-acde48001122 version: 5 -date: '2024-11-13' +date: '2025-01-13' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the execution of `net.exe` or `net1.exe` - with command-line arguments used to query domain users. It leverages data from Endpoint - Detection and Response (EDR) agents, focusing on process names and command-line - executions. This activity is significant as it may indicate an attempt by adversaries - to enumerate domain users for situational awareness and Active Directory discovery. - If confirmed malicious, this behavior could allow attackers to map out user accounts, - potentially leading to further exploitation or lateral movement within the network. +description: This following analytic has been deprecated in favour of the generic version "5d0d4830-0133-11ec-bae3-acde48001122". The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out user accounts, potentially leading to further exploitation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/deprecated/domain_group_discovery_with_net.yml similarity index 74% rename from detections/endpoint/domain_group_discovery_with_net.yml rename to detections/deprecated/domain_group_discovery_with_net.yml index db7bba1982..af3f1f4e79 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/deprecated/domain_group_discovery_with_net.yml @@ -1,18 +1,11 @@ name: Domain Group Discovery With Net id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 version: 6 -date: '2024-12-16' +date: '2025-01-13' author: Mauricio Velazco, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic identifies the execution of `net.exe` with command-line - arguments used to query domain groups, specifically `group /domain`. It leverages - data from Endpoint Detection and Response (EDR) agents, focusing on process names - and command-line arguments. This activity is significant as it indicates potential - reconnaissance efforts by adversaries to enumerate domain groups, which is a common - step in Active Directory Discovery. If confirmed malicious, this behavior could - allow attackers to gain insights into the domain structure, aiding in further attacks - such as privilege escalation or lateral movement. +description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic identifies the execution of `net.exe` with command-line arguments used to query domain groups, specifically `group /domain`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/deprecated/elevated_group_discovery_with_net.yml similarity index 96% rename from detections/endpoint/elevated_group_discovery_with_net.yml rename to detections/deprecated/elevated_group_discovery_with_net.yml index 04c2e9a3ee..14e1b5ab5a 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/deprecated/elevated_group_discovery_with_net.yml @@ -1,11 +1,12 @@ name: Elevated Group Discovery With Net id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -version: 5 -date: '2024-12-10' +version: 6 +date: '2025-01-24' author: Mauricio Velazco, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the execution of `net.exe` or `net1.exe` +description: The following analytic has been deprecated. + The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query elevated domain groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/deprecated/excel_spawning_powershell.yml similarity index 93% rename from detections/endpoint/excel_spawning_powershell.yml rename to detections/deprecated/excel_spawning_powershell.yml index 14609579ca..83c5d6bd07 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/deprecated/excel_spawning_powershell.yml @@ -1,11 +1,12 @@ name: Excel Spawning PowerShell id: 42d40a22-9be3-11eb-8f08-acde48001122 -version: 7 -date: '2024-12-10' +version: 8 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects Microsoft Excel spawning PowerShell, an +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects Microsoft Excel spawning PowerShell, an uncommon and suspicious behavior. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is "excel.exe" and the child process is PowerShell. This activity is significant diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/deprecated/excel_spawning_windows_script_host.yml similarity index 91% rename from detections/endpoint/excel_spawning_windows_script_host.yml rename to detections/deprecated/excel_spawning_windows_script_host.yml index 1985646f4b..db56778daf 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/deprecated/excel_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Excel Spawning Windows Script Host id: 57fe880a-9be3-11eb-9bf3-acde48001122 -version: 7 -date: '2024-12-10' +version: 9 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Excel spawns +description: The following analytic has been deprecated in favour of a more generic approach. + The following analytic identifies instances where Microsoft Excel spawns Windows Script Host processes (`cscript.exe` or `wscript.exe`). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is `excel.exe`. This activity is significant @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/deprecated/excessive_service_stop_attempt.yml similarity index 95% rename from detections/endpoint/excessive_service_stop_attempt.yml rename to detections/deprecated/excessive_service_stop_attempt.yml index 53e38d2105..3e27dc456b 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/deprecated/excessive_service_stop_attempt.yml @@ -1,11 +1,12 @@ name: Excessive Service Stop Attempt id: ae8d3f4a-acd7-11eb-8846-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Anomaly -description: The following analytic detects multiple attempts to stop or delete services +description: The following analytic has been deprecated. + The following analytic detects multiple attempts to stop or delete services on a system using `net.exe`, `sc.exe`, or `net1.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/deprecated/excessive_usage_of_net_app.yml similarity index 95% rename from detections/endpoint/excessive_usage_of_net_app.yml rename to detections/deprecated/excessive_usage_of_net_app.yml index 37956c9bd9..1b3556f57b 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/deprecated/excessive_usage_of_net_app.yml @@ -1,11 +1,12 @@ name: Excessive Usage Of Net App id: 45e52536-ae42-11eb-b5c6-acde48001122 -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Anomaly -description: The following analytic detects excessive usage of `net.exe` or `net1.exe` +description: The following analytic has been deprecated. + The following analytic detects excessive usage of `net.exe` or `net1.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/deprecated/extraction_of_registry_hives.yml similarity index 96% rename from detections/endpoint/extraction_of_registry_hives.yml rename to detections/deprecated/extraction_of_registry_hives.yml index 9002c8def1..f31196f4e5 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/deprecated/extraction_of_registry_hives.yml @@ -1,11 +1,12 @@ name: Extraction of Registry Hives id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-01-24' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of `reg.exe` to export Windows +description: The following analytic has been deprecated. + The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/deprecated/linux_auditd_find_private_keys.yml similarity index 95% rename from detections/endpoint/linux_auditd_find_private_keys.yml rename to detections/deprecated/linux_auditd_find_private_keys.yml index 947dca19a4..e9b889bc9e 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/deprecated/linux_auditd_find_private_keys.yml @@ -1,11 +1,12 @@ name: Linux Auditd Find Private Keys id: 80bb9988-190b-4ee0-a3c3-509545a8f678 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects suspicious attempts to find private keys, +description: The following analytic has been deprecated. + The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/deprecated/local_account_discovery_with_net.yml similarity index 93% rename from detections/endpoint/local_account_discovery_with_net.yml rename to detections/deprecated/local_account_discovery_with_net.yml index bb0a6ad627..7ac754da20 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/deprecated/local_account_discovery_with_net.yml @@ -1,11 +1,12 @@ name: Local Account Discovery with Net id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-01-24' author: Mauricio Velazco, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic detects the execution of `net.exe` or `net1.exe` +description: The following analytic has been deprecated. + The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/deprecated/mshtml_module_load_in_office_product.yml similarity index 95% rename from detections/endpoint/mshtml_module_load_in_office_product.yml rename to detections/deprecated/mshtml_module_load_in_office_product.yml index 587a0aae86..f617d2f40e 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/deprecated/mshtml_module_load_in_office_product.yml @@ -1,11 +1,12 @@ name: MSHTML Module Load in Office Product id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-01-24' author: Michael Haag, Mauricio Velazco, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the loading of the mshtml.dll module into +description: The following analytic has been deprecated. + The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/deprecated/net_localgroup_discovery.yml similarity index 78% rename from detections/endpoint/net_localgroup_discovery.yml rename to detections/deprecated/net_localgroup_discovery.yml index dd4243378c..e54388cb4c 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/deprecated/net_localgroup_discovery.yml @@ -1,17 +1,11 @@ name: Net Localgroup Discovery id: 54f5201e-155b-11ec-a6e2-acde48001122 version: 5 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic detects the execution of the `net localgroup` - command, which is used to enumerate local group memberships on a system. It leverages - data from Endpoint Detection and Response (EDR) agents, focusing on process execution - logs that include command-line details. This activity is significant because it - can indicate an attacker is gathering information about local group memberships, - potentially to identify privileged accounts. If confirmed malicious, this behavior - could lead to further privilege escalation or lateral movement within the network. +description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic detects the execution of the `net localgroup` command, which is used to enumerate local group memberships on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it can indicate an attacker is gathering information about local group memberships, potentially to identify privileged accounts. If confirmed malicious, this behavior could lead to further privilege escalation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/network_connection_discovery_with_net.yml b/detections/deprecated/network_connection_discovery_with_net.yml similarity index 93% rename from detections/endpoint/network_connection_discovery_with_net.yml rename to detections/deprecated/network_connection_discovery_with_net.yml index 81e3c9ac8b..0002699f31 100644 --- a/detections/endpoint/network_connection_discovery_with_net.yml +++ b/detections/deprecated/network_connection_discovery_with_net.yml @@ -1,11 +1,12 @@ name: Network Connection Discovery With Net id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -version: 5 -date: '2024-12-10' +version: 6 +date: '2025-01-24' author: Mauricio Velazco, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` +description: The following analytic has been deprecated. + The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to list network connections on a compromised system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/deprecated/office_application_drop_executable.yml similarity index 96% rename from detections/endpoint/office_application_drop_executable.yml rename to detections/deprecated/office_application_drop_executable.yml index 0f58d8a853..94ddc48e52 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/deprecated/office_application_drop_executable.yml @@ -1,11 +1,12 @@ name: Office Application Drop Executable id: 73ce70c4-146d-11ec-9184-acde48001122 -version: 8 -date: '2024-12-10' +version: 9 +date: '2025-01-24' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github -status: production +status: deprecated type: TTP -description: The following analytic detects Microsoft Office applications dropping +description: The following analytic has been deprecated. + The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as .exe, .dll, or .ps1. diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/deprecated/office_application_spawn_regsvr32_process.yml similarity index 94% rename from detections/endpoint/office_application_spawn_regsvr32_process.yml rename to detections/deprecated/office_application_spawn_regsvr32_process.yml index 286df616c9..20aef6978a 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/deprecated/office_application_spawn_regsvr32_process.yml @@ -1,11 +1,12 @@ name: Office Application Spawn Regsvr32 process id: 2d9fc90c-f11f-11eb-9300-acde48001122 version: 8 -date: '2024-12-10' +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where an Office application +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where an Office application spawns a Regsvr32 process, which is often indicative of macro execution or malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is a known Office application. diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/deprecated/office_application_spawn_rundll32_process.yml similarity index 94% rename from detections/endpoint/office_application_spawn_rundll32_process.yml rename to detections/deprecated/office_application_spawn_rundll32_process.yml index d42b43116e..fd944b75cf 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/deprecated/office_application_spawn_rundll32_process.yml @@ -1,11 +1,12 @@ name: Office Application Spawn rundll32 process id: 958751e4-9c5f-11eb-b103-acde48001122 version: 8 -date: '2024-12-10' +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where an Office application +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where an Office application spawns a rundll32 process, which is often indicative of macro execution or malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is a known Office application. diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/deprecated/office_document_creating_schedule_task.yml similarity index 95% rename from detections/endpoint/office_document_creating_schedule_task.yml rename to detections/deprecated/office_document_creating_schedule_task.yml index ecf8d25fa8..0198d43de6 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/deprecated/office_document_creating_schedule_task.yml @@ -1,11 +1,12 @@ name: Office Document Creating Schedule Task id: cc8b7b74-9d0f-11eb-8342-acde48001122 -version: 9 -date: '2024-11-13' +version: 10 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects an Office document creating a scheduled +description: The following analytic has been deprecated. + The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or by loading `taskschd.dll`. This detection leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` file. This activity is significant as it is a common technique used by malicious diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/deprecated/office_document_executing_macro_code.yml similarity index 95% rename from detections/endpoint/office_document_executing_macro_code.yml rename to detections/deprecated/office_document_executing_macro_code.yml index b309792fc2..920e9483f5 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/deprecated/office_document_executing_macro_code.yml @@ -1,11 +1,12 @@ name: Office Document Executing Macro Code id: b12c89bc-9d06-11eb-a592-acde48001122 -version: 8 -date: '2024-11-13' +version: 9 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies office documents executing macro code. +description: The following analytic has been deprecated. + The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant because macros are a common attack vector for delivering malicious payloads, such diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/deprecated/office_document_spawned_child_process_to_download.yml similarity index 96% rename from detections/endpoint/office_document_spawned_child_process_to_download.yml rename to detections/deprecated/office_document_spawned_child_process_to_download.yml index eb35cf0a89..def3130752 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/deprecated/office_document_spawned_child_process_to_download.yml @@ -1,11 +1,12 @@ name: Office Document Spawned Child Process To Download id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -version: 9 -date: '2024-11-13' +version: 10 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies Office applications spawning child +description: The following analytic has been deprecated. + The following analytic identifies Office applications spawning child processes to download content via HTTP/HTTPS. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications like Word or Excel initiate network connections, excluding common browsers. This diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/deprecated/office_product_spawn_cmd_process.yml similarity index 84% rename from detections/endpoint/office_product_spawn_cmd_process.yml rename to detections/deprecated/office_product_spawn_cmd_process.yml index 1491dedaab..812d2a3bc1 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/deprecated/office_product_spawn_cmd_process.yml @@ -1,18 +1,12 @@ name: Office Product Spawn CMD Process id: b8b19420-e892-11eb-9244-acde48001122 -version: 8 -date: '2024-11-13' +version: 9 +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects an Office product spawning a CMD process, - which is indicative of a macro executing shell commands to download or run malicious - code. This detection leverages data from Endpoint Detection and Response (EDR) agents, - focusing on process and parent process names. This activity is significant as it - often signals the execution of malicious payloads, such as those seen in Trickbot - spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized - code execution, potentially compromising the system and allowing further malicious - activities. +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects an Office product spawning a CMD process, which is indicative of a macro executing shell commands to download or run malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names. This activity is significant as it often signals the execution of malicious payloads, such as those seen in Trickbot spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/deprecated/office_product_spawning_bitsadmin.yml similarity index 94% rename from detections/endpoint/office_product_spawning_bitsadmin.yml rename to detections/deprecated/office_product_spawning_bitsadmin.yml index 0918e577ab..8c3de51640 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/deprecated/office_product_spawning_bitsadmin.yml @@ -1,11 +1,12 @@ name: Office Product Spawning BITSAdmin id: e8c591f4-a6d7-11eb-8cf7-acde48001122 version: 9 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `bitsadmin.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `bitsadmin.exe`, a behavior often associated with malware families like TA551 and IcedID. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because `bitsadmin.exe` diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/deprecated/office_product_spawning_certutil.yml similarity index 94% rename from detections/endpoint/office_product_spawning_certutil.yml rename to detections/deprecated/office_product_spawning_certutil.yml index 7f97b4ac57..d1e14b4181 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/deprecated/office_product_spawning_certutil.yml @@ -1,11 +1,12 @@ name: Office Product Spawning CertUtil id: 6925fe72-a6d5-11eb-9e17-acde48001122 version: 9 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `certutil.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `certutil.exe`, a behavior often associated with malware families like TA551 and IcedID. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process relationships and command-line executions. The significance lies in the fact that `certutil.exe` diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/deprecated/office_product_spawning_mshta.yml similarity index 90% rename from detections/endpoint/office_product_spawning_mshta.yml rename to detections/deprecated/office_product_spawning_mshta.yml index 696bf2540d..966d3f3b98 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/deprecated/office_product_spawning_mshta.yml @@ -1,11 +1,12 @@ name: Office Product Spawning MSHTA id: 6078fa20-a6d2-11eb-b662-acde48001122 version: 8 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where a Microsoft Office +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where a Microsoft Office product spawns `mshta.exe`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is an Office application. This activity is significant because it is a common @@ -80,7 +81,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml similarity index 95% rename from detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml rename to detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml index 70cb99e96f..34040e8cb5 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml @@ -1,11 +1,12 @@ name: Office Product Spawning Rundll32 with no DLL id: c661f6be-a38c-11eb-be57-acde48001122 -version: 9 -date: '2024-12-10' +version: 10 +date: '2025-01-24' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `rundll32.exe` +description: The following analytic has been deprecated. + The following analytic detects any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process and parent process relationships. This activity is significant as it is a known tactic of the IcedID malware family, diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/deprecated/office_product_spawning_windows_script_host.yml similarity index 91% rename from detections/endpoint/office_product_spawning_windows_script_host.yml rename to detections/deprecated/office_product_spawning_windows_script_host.yml index 903cde52fb..8ff8d57259 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/deprecated/office_product_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Office Product Spawning Windows Script Host id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 -version: 10 -date: '2024-12-10' +version: 11 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects an Office product spawning WScript.exe +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects an Office product spawning WScript.exe or CScript.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent processes. This activity is significant because it may indicate the execution of potentially @@ -83,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/deprecated/office_product_spawning_wmic.yml similarity index 91% rename from detections/endpoint/office_product_spawning_wmic.yml rename to detections/deprecated/office_product_spawning_wmic.yml index 5b92510727..6360ea5c4e 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/deprecated/office_product_spawning_wmic.yml @@ -1,11 +1,12 @@ name: Office Product Spawning Wmic id: ffc236d6-a6c9-11eb-95f1-acde48001122 version: 10 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `wmic.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `wmic.exe`, specifically when the command-line of `wmic.exe` contains `wmic process call create`. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant @@ -81,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/deprecated/office_product_writing_cab_or_inf.yml similarity index 96% rename from detections/endpoint/office_product_writing_cab_or_inf.yml rename to detections/deprecated/office_product_writing_cab_or_inf.yml index 929ddd4902..dbea8b4ac3 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/deprecated/office_product_writing_cab_or_inf.yml @@ -1,11 +1,12 @@ name: Office Product Writing cab or inf id: f48cd1d4-125a-11ec-a447-acde48001122 -version: 9 -date: '2024-12-10' +version: 10 +date: '2025-01-24' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects Office products writing .cab or .inf files, +description: The following analytic has been deprecated. + The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and Endpoint.Filesystem data models to identify Office applications creating these file types. This activity is significant as it may signal an attempt to load malicious diff --git a/detections/endpoint/office_spawning_control.yml b/detections/deprecated/office_spawning_control.yml similarity index 96% rename from detections/endpoint/office_spawning_control.yml rename to detections/deprecated/office_spawning_control.yml index d31ef598e1..8f472a4168 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/deprecated/office_spawning_control.yml @@ -1,11 +1,12 @@ name: Office Spawning Control id: 053e027c-10c7-11ec-8437-acde48001122 -version: 9 -date: '2024-12-10' +version: 11 +date: '2025-01-24' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where `control.exe` is spawned +description: The following analytic has been deprecated. + The following analytic identifies instances where `control.exe` is spawned by a Microsoft Office product. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because it can indicate exploitation attempts related to CVE-2021-40444, diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/detections/deprecated/osquery_pack___coldroot_detection.yml index 3ba9866bed..369173b8fd 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/detections/deprecated/osquery_pack___coldroot_detection.yml @@ -1,6 +1,6 @@ name: Osquery pack - ColdRoot detection id: a6fffe5e-05c3-4c04-badc-887607fbb8dc -version: 4 +version: 5 date: '2024-11-14' author: Rico Valdez, Splunk status: deprecated diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/deprecated/password_policy_discovery_with_net.yml similarity index 94% rename from detections/endpoint/password_policy_discovery_with_net.yml rename to detections/deprecated/password_policy_discovery_with_net.yml index b29fff9632..0656e661c8 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/deprecated/password_policy_discovery_with_net.yml @@ -1,11 +1,12 @@ name: Password Policy Discovery with Net id: 09336538-065a-11ec-8665-acde48001122 -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-01-24' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` +description: The following analytic has been deprecated. + The following analytic identifies the execution of `net.exe` or `net1.exe` with command line arguments aimed at obtaining the domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential diff --git a/detections/deprecated/remote_system_discovery_with_net.yml b/detections/deprecated/remote_system_discovery_with_net.yml new file mode 100644 index 0000000000..2377264b52 --- /dev/null +++ b/detections/deprecated/remote_system_discovery_with_net.yml @@ -0,0 +1,36 @@ +name: Remote System Discovery with Net +id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 +version: 5 +date: '2025-01-13' +author: Mauricio Velazco, Splunk +status: deprecated +type: Hunting +description: The following analytic has been deprecated in favour of two dedicated analytics "4dc3951f-b3f8-4f46-b412-76a483f72277" and "a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" .The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to discover remote systems, such as `domain computers /domain`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out networked systems and Active Directory structures. If confirmed malicious, this behavior could lead to further network exploitation, privilege escalation, or lateral movement within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*domain computers*" AND Processes.process=*/do*) OR (Processes.process="*view*" AND Processes.process=*/do*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1018/ +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +tags: + analytic_story: + - Active Directory Discovery + - IcedID + asset_type: Endpoint + mitre_attack_id: + - T1018 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_command_shell_fetch_env_variables.yml b/detections/deprecated/windows_command_shell_fetch_env_variables.yml similarity index 95% rename from detections/endpoint/windows_command_shell_fetch_env_variables.yml rename to detections/deprecated/windows_command_shell_fetch_env_variables.yml index fa3d2cb8d1..90618ba3e5 100644 --- a/detections/endpoint/windows_command_shell_fetch_env_variables.yml +++ b/detections/deprecated/windows_command_shell_fetch_env_variables.yml @@ -1,11 +1,12 @@ name: Windows Command Shell Fetch Env Variables id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies a suspicious process command line fetching +description: The following analytic has been deprecated. + The following analytic identifies a suspicious process command line fetching environment variables with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity is significant as it is commonly associated with malware diff --git a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml index 0611c1c8f6..47789c6b30 100644 --- a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml +++ b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml @@ -1,6 +1,6 @@ name: Windows Lateral Tool Transfer RemCom id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0 -version: 5 +version: 6 date: '2024-12-10' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_modify_registry_reg_restore.yml b/detections/deprecated/windows_modify_registry_reg_restore.yml similarity index 94% rename from detections/endpoint/windows_modify_registry_reg_restore.yml rename to detections/deprecated/windows_modify_registry_reg_restore.yml index 49d359ba74..f63d1b0214 100644 --- a/detections/endpoint/windows_modify_registry_reg_restore.yml +++ b/detections/deprecated/windows_modify_registry_reg_restore.yml @@ -1,11 +1,12 @@ name: Windows Modify Registry Reg Restore id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic detects the execution of reg.exe with the "restore" +description: The following analytic has been deprecated. + The following analytic detects the execution of reg.exe with the "restore" parameter, indicating an attempt to restore registry backup data on a host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/deprecated/windows_msiexec_with_network_connections.yml similarity index 96% rename from detections/endpoint/windows_msiexec_with_network_connections.yml rename to detections/deprecated/windows_msiexec_with_network_connections.yml index 713896a6b0..5c17518468 100644 --- a/detections/endpoint/windows_msiexec_with_network_connections.yml +++ b/detections/deprecated/windows_msiexec_with_network_connections.yml @@ -1,11 +1,12 @@ name: Windows MSIExec With Network Connections id: 827409a1-5393-4d8d-8da4-bbb297c262a7 -version: 5 -date: '2024-11-13' +version: 7 +date: '2025-01-24' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects MSIExec making network connections over +description: The following analytic has been deprecated. + The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity diff --git a/detections/endpoint/windows_network_share_interaction_with_net.yml b/detections/deprecated/windows_network_share_interaction_with_net.yml similarity index 95% rename from detections/endpoint/windows_network_share_interaction_with_net.yml rename to detections/deprecated/windows_network_share_interaction_with_net.yml index dbdfa7f59d..fea71519c1 100644 --- a/detections/endpoint/windows_network_share_interaction_with_net.yml +++ b/detections/deprecated/windows_network_share_interaction_with_net.yml @@ -1,13 +1,14 @@ name: Windows Network Share Interaction With Net id: 4dc3951f-b3f8-4f46-b412-76a483f72277 -version: 4 -date: '2024-12-10' +version: 6 +date: '2025-01-24' author: Dean Luxton -status: production +status: deprecated type: TTP data_source: - Sysmon EventID 1 -description: This analytic detects network share discovery and collection activities +description: The following analytic has been deprecated. + This analytic detects network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/deprecated/windows_office_product_spawning_msdt.yml similarity index 93% rename from detections/endpoint/windows_office_product_spawning_msdt.yml rename to detections/deprecated/windows_office_product_spawning_msdt.yml index 1017755ad3..cfdabb0241 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/deprecated/windows_office_product_spawning_msdt.yml @@ -1,11 +1,12 @@ name: Windows Office Product Spawning MSDT id: 127eba64-c981-40bf-8589-1830638864a7 -version: 9 -date: '2024-12-10' +version: 10 +date: '2025-01-24' author: Michael Haag, Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects a Microsoft Office product spawning the +description: The following analytic has been deprecated. + The following analytic detects a Microsoft Office product spawning the Windows msdt.exe process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt @@ -90,7 +91,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_query_registry_reg_save.yml b/detections/deprecated/windows_query_registry_reg_save.yml similarity index 94% rename from detections/endpoint/windows_query_registry_reg_save.yml rename to detections/deprecated/windows_query_registry_reg_save.yml index 8b30088660..291c0cf7a0 100644 --- a/detections/endpoint/windows_query_registry_reg_save.yml +++ b/detections/deprecated/windows_query_registry_reg_save.yml @@ -1,11 +1,12 @@ name: Windows Query Registry Reg Save id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 -version: 4 -date: '2024-11-13' +version: 6 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic detects the execution of the reg.exe process with +description: The following analytic has been deprecated. + The following analytic detects the execution of the reg.exe process with the "save" parameter. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" command diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml similarity index 95% rename from detections/endpoint/windows_service_stop_via_net__and_sc_application.yml rename to detections/deprecated/windows_service_stop_via_net__and_sc_application.yml index 5564a307a4..00ff416650 100644 --- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ b/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml @@ -1,11 +1,12 @@ name: Windows Service Stop Via Net and SC Application id: 827af04b-0d08-479b-9b84-b7d4644e4b80 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Anomaly -description: The following analytic identifies attempts to stop services on a system +description: The following analytic has been deprecated. + The following analytic identifies attempts to stop services on a system using `net.exe` or `sc.exe`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line executions. This activity is significant as adversaries often terminate security or critical services diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/deprecated/windows_valid_account_with_never_expires_password.yml similarity index 95% rename from detections/endpoint/windows_valid_account_with_never_expires_password.yml rename to detections/deprecated/windows_valid_account_with_never_expires_password.yml index ff0b99e91e..01b416d1d5 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/deprecated/windows_valid_account_with_never_expires_password.yml @@ -1,11 +1,12 @@ name: Windows Valid Account With Never Expires Password id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 -version: 5 -date: '2024-12-10' +version: 6 +date: '2025-01-24' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the use of net.exe to update user account +description: The following analytic has been deprecated. + The following analytic detects the use of net.exe to update user account policies to set passwords as non-expiring. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited". This activity is significant as it can indicate an attempt to maintain persistence, diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/deprecated/winword_spawning_cmd.yml similarity index 90% rename from detections/endpoint/winword_spawning_cmd.yml rename to detections/deprecated/winword_spawning_cmd.yml index 286902e5df..5760517a84 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/deprecated/winword_spawning_cmd.yml @@ -1,11 +1,12 @@ name: Winword Spawning Cmd id: 6fcbaedc-a37b-11eb-956b-acde48001122 version: 7 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Word (winword.exe) +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where Microsoft Word (winword.exe) spawns the command prompt (cmd.exe). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is winword.exe. This activity is significant because it is uncommon and @@ -81,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/deprecated/winword_spawning_powershell.yml similarity index 91% rename from detections/endpoint/winword_spawning_powershell.yml rename to detections/deprecated/winword_spawning_powershell.yml index 97e512c743..b2e102dc75 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/deprecated/winword_spawning_powershell.yml @@ -1,11 +1,12 @@ name: Winword Spawning PowerShell id: b2c950b8-9be2-11eb-8658-acde48001122 version: 7 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Word (winword.exe) +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where Microsoft Word (winword.exe) spawns a PowerShell process. This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is winword.exe. This activity is significant because it is uncommon and @@ -84,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/deprecated/winword_spawning_windows_script_host.yml similarity index 91% rename from detections/endpoint/winword_spawning_windows_script_host.yml rename to detections/deprecated/winword_spawning_windows_script_host.yml index df2997ec4a..16ee7d84c1 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/deprecated/winword_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Winword Spawning Windows Script Host id: 637e1b5c-9be1-11eb-9c32-acde48001122 version: 6 -date: '2024-12-10' +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Winword.exe +description: The following analytic has been deprecated in favour of a more generic approach. + The following analytic identifies instances where Microsoft Winword.exe spawns Windows Script Host processes (cscript.exe or wscript.exe). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is Winword.exe. This activity is significant @@ -79,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index 4d16ba9cb6..cf78828ce7 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -1,7 +1,7 @@ name: Add or Set Windows Defender Exclusion id: 773b66fe-4dd9-11ec-8289-acde48001122 -version: 6 -date: '2024-12-10' +version: '6' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -65,14 +65,15 @@ rba: threat_objects: [] tags: analytic_story: - - WhisperGate - - Windows Defense Evasion Tactics + - CISA AA22-320A + - AgentTesla - Remcos - Data Destruction - - CISA AA22-320A - - ValleyRAT - Compromised Windows Host - - AgentTesla + - ValleyRAT + - Windows Defense Evasion Tactics + - WhisperGate + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1562.001 diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 952bab98c5..c92c682b76 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -1,6 +1,6 @@ name: Anomalous usage of 7zip id: 9364ee8e-a39a-11eb-8f1d-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index df81ee7f38..65331578b1 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,7 +1,7 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: 8 -date: '2024-11-13' +version: 10 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -71,15 +71,18 @@ rba: type: process_name tags: analytic_story: - - DarkCrystal RAT - - Ingress Tool Transfer - - Hermetic Wiper - - Malicious PowerShell - Data Destruction - - Log4Shell CVE-2021-44228 - - Phemedrone Stealer - - Braodo Stealer + - Ingress Tool Transfer + - DarkCrystal RAT - PXA Stealer + - Braodo Stealer + - Phemedrone Stealer + - Log4Shell CVE-2021-44228 + - Malicious PowerShell + - Hermetic Wiper + - Crypto Stealer + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint cve: - CVE-2021-44228 @@ -95,7 +98,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 3a5fdced6f..c94d2f49c5 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -1,6 +1,6 @@ name: Any Powershell DownloadString id: 4d015ef2-7adf-11eb-95da-acde48001122 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index e23a285c6c..e9c57444bf 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -1,6 +1,6 @@ name: Attempt To Add Certificate To Untrusted Store id: 6bc5243e-ef36-45dc-9b12-f4a6be131159 -version: 11 +version: 12 date: '2024-11-13' author: Patrick Bareiss, Rico Valdez, Splunk status: production diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 8702c43326..b7fa5f29ff 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -30,7 +30,7 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: It is possible for this search to generate a notable event +known_false_positives: It is possible for this search to generate a finding event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 29bdb7ba33..1425eee424 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -1,6 +1,6 @@ name: BCDEdit Failure Recovery Modification id: 809b31d2-5462-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index b115098430..eee12eeb44 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -1,6 +1,6 @@ name: BITS Job Persistence id: e97a5ffe-90bf-11eb-928a-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index da8e3522bb..bdab9e207a 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -1,6 +1,6 @@ name: BITSAdmin Download File id: 80630ff4-8e4c-11eb-aab5-acde48001122 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Sittikorn S status: production diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 7e3407c516..b6d19b0b39 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -1,6 +1,6 @@ name: CertUtil Download With URLCache and Split Arguments id: 415b4306-8bfb-11eb-85c4-acde48001122 -version: 9 +version: 10 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 7c6a453b69..97a0c24ba9 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -1,6 +1,6 @@ name: CertUtil Download With VerifyCtl and Split Arguments id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -version: 9 +version: 10 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 34b29335c5..6dafec9ff9 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -1,6 +1,6 @@ name: Certutil exe certificate extraction id: 337a46be-600f-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2024-12-10' author: Rod Soto, Splunk status: production diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 0fc4d9b902..f00b0f4387 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -1,6 +1,6 @@ name: CertUtil With Decode Argument id: bfe94226-8c10-11eb-a4b3-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index ff33bdae75..056af37cda 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -65,9 +65,10 @@ rba: threat_objects: [] tags: analytic_story: - - IcedID - Azorult - Forest Blizzard + - Crypto Stealer + - IcedID asset_type: Endpoint mitre_attack_id: - T1059 diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index abb19e8ac8..b5f5648875 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -1,6 +1,6 @@ name: Check Elevated CMD using whoami id: a9079b18-1633-11ec-859c-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index ee6d5594e2..2e3eaddaf9 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -1,6 +1,6 @@ name: Clear Unallocated Sector Using Cipher App id: cd80a6ac-c9d9-11eb-8839-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 0be756484b..3618dec57d 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Clop Common Exec Parameter id: 5a8a2a72-8322-11eb-9ee9-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 7be19f62bc..ead8c6acad 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -38,26 +38,27 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - AsyncRAT - - Winter Vivern - - WhisperGate - - Living Off The Land + - Data Destruction - DarkGate Malware - - ProxyNotShell - - Log4Shell CVE-2021-44228 - - NjRAT - - RedLine Stealer - - Rhysida Ransomware - - IcedID - Chaos Ransomware - - PlugX - - Azorult - - Qakbot - Hermetic Wiper - Warzone RAT - - DarkCrystal RAT + - Winter Vivern + - ProxyNotShell + - IcedID + - Living Off The Land + - NjRAT + - Log4Shell CVE-2021-44228 - CISA AA23-347A - - Data Destruction + - AsyncRAT + - Rhysida Ransomware + - DarkCrystal RAT + - Crypto Stealer + - Azorult + - Qakbot + - RedLine Stealer + - PlugX + - WhisperGate asset_type: Endpoint cve: - CVE-2021-44228 diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 618a7f1670..107dc77582 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -1,6 +1,6 @@ name: CMD Echo Pipe - Escalation id: eb277ba0-b96b-11eb-b00e-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index f13150655f..b7dbef7eb3 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,6 +1,6 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 10 +version: 11 date: '2025-01-07' author: David Dorsey, Michael Haag, Splunk, Steven Dick status: production @@ -27,8 +27,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ how_to_implement: 'You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data model node. To see the additional metadata, add the following fields, if not already present, please review - the detailed documentation on how to create a new field within Incident Review may - be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' + the detailed documentation on how to create a new field within Incident Review' known_false_positives: It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions. diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index fe3227dd29..68ddb073f8 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Conti Common Exec parameter id: 624919bc-c382-11eb-adcc-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 0b02258a47..aaddd2c8b2 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -1,6 +1,6 @@ name: Control Loading from World Writable Directory id: 10423ac4-10c9-11ec-8dc4-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index c90a12c6e9..2b94e92f3d 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -1,6 +1,6 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c -version: 10 +version: 11 date: '2024-12-12' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 43b2d363b6..89b5ebed9b 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -1,6 +1,6 @@ name: Deleting Shadow Copies id: b89919ed-ee5f-492c-b139-95dbb162039e -version: 9 +version: 10 date: '2024-12-10' author: David Dorsey, Splunk status: production diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index a20929459c..406db0ca35 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect AzureHound Command-Line Arguments id: 26f02e96-c300-11eb-b611-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml index 38e25e1fcc..80357f3580 100644 --- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml @@ -1,6 +1,6 @@ name: Detect Certify With PowerShell Script Block Logging id: f533ca6c-9440-4686-80cb-7f294c07812a -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml index 932c36dce7..48a6a3129b 100644 --- a/detections/endpoint/detect_certipy_file_modifications.yml +++ b/detections/endpoint/detect_certipy_file_modifications.yml @@ -1,6 +1,6 @@ name: Detect Certipy File Modifications id: 7e3df743-b1d8-4631-8fa8-bd5819688876 -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 05aed6328e..7bbbcdff80 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -1,6 +1,6 @@ name: Detect HTML Help Spawn Child Process id: 723716de-ee55-4cd4-9759-c44e7e55ba4b -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index d72c7f64a1..b91592327f 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 0960910cc8..d3616fae42 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -1,6 +1,6 @@ name: Detect Mimikatz With PowerShell Script Block Logging id: 8148c29c-c952-11eb-9255-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 09c4f17867..7c5118b8b9 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -1,6 +1,6 @@ name: Detect mshta inline hta execution id: a0873b32-5b68-11eb-ae93-0242ac130002 -version: 12 +version: 13 date: '2024-12-10' author: Bhavin Patel, Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 7a9bc24261..ca6dcb56be 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml index eabd5f854f..bd82127859 100644 --- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml +++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml @@ -65,6 +65,7 @@ rba: tags: analytic_story: - Compromised User Account + - Crypto Stealer asset_type: Account mitre_attack_id: - T1110.003 diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index f6f07579ae..0151aeb432 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -1,6 +1,6 @@ name: Detect Path Interception By Creation Of program exe id: cbef820c-e1ff-407f-887f-0a9240a2d477 -version: 9 +version: 10 date: '2024-11-13' author: Patrick Bareiss, Splunk status: production diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 6004101254..24de8df12b 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -1,6 +1,6 @@ name: Detect PsExec With accepteula Flag id: 27c3a83d-cada-47c6-9042-67baf19d2574 -version: 8 +version: 9 date: '2024-11-13' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index 000378485f..b97ff44ccd 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -60,6 +60,7 @@ tags: analytic_story: - Unusual Processes - Rhysida Ransomware + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1204 diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 31e5bc6329..a36e49cace 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,6 +1,6 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index edd0e0652f..008e3a9fdf 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Detect Regasm Spawning a Process id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 3431b74b40..39e4bbbd17 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect Regasm with no Command Line Arguments id: c3bc1430-04e7-4178-835f-047d8e6e97df -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 369fa49db9..621501a8a9 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Detect Regsvcs Spawning a Process id: bc477b57-5c21-4ab6-9c33-668772e7f114 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index c8dfa3767d..05dfb21ac7 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect Regsvcs with No Command Line Arguments id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index e2130893c1..ba41b5d992 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -1,6 +1,6 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index e28038219d..3b2380accc 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,7 +1,7 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 9 -date: '2024-11-13' +version: 10 +date: '2025-01-27' author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production type: Hunting @@ -39,15 +39,17 @@ references: - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ tags: analytic_story: - - SamSam Ransomware - - DHS Report TA18-074A - - HAFNIUM Group - - DarkSide Ransomware - - Active Directory Lateral Movement - - CISA AA22-320A - - Sandworm Tools - BlackByte Ransomware + - DHS Report TA18-074A + - DarkSide Ransomware + - SamSam Ransomware + - CISA AA22-320A + - HAFNIUM Group + - Sandworm Tools + - Active Directory Lateral Movement + - Nexus APT Threat Activity - DarkGate Malware + - Earth Estries - Rhysida Ransomware asset_type: Endpoint mitre_attack_id: @@ -61,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 08dbb45f87..43af74579c 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -1,7 +1,7 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 7 -date: '2024-11-13' +version: 8 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: Hunting @@ -39,6 +39,8 @@ references: tags: analytic_story: - Collection and Staging + - Earth Estries + - Nexus APT Threat Activity - CISA AA22-277A asset_type: Endpoint mitre_attack_id: @@ -52,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 8774c0b8e9..8e285e9c2f 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - advpack id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 5870f0e87b..c61eded5b1 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - setupapi id: 61e7b44a-6088-4f26-b788-9a96ba13b37a -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index cab866b351..58bfea6011 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - syssetup id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml index 6fa1b4cdd0..93af7b9881 100644 --- a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml +++ b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml @@ -1,6 +1,6 @@ name: Detect suspicious processnames using pretrained model in DSDL id: a15f8977-ad7d-4669-92ef-b59b97219bf5 -version: 4 +version: 5 date: '2024-11-13' author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index a244b2a733..9e42a31685 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -1,6 +1,6 @@ name: DNS Exfiltration Using Nslookup App id: 2452e632-9e0d-11eb-bacd-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Teoderick Contreras, Splunk, Wouter Jansen status: production diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 4845d14bdd..97a948b1af 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -50,9 +50,10 @@ rba: threat_objects: [] tags: analytic_story: - - XMRig - Phemedrone Stealer + - Crypto Stealer - Snake Keylogger + - XMRig asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 3ee0399230..72e21dfb8e 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -1,6 +1,6 @@ name: DSQuery Domain Discovery id: cc316032-924a-11eb-91a2-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index ea6d606030..f2ca5506a9 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -1,6 +1,6 @@ name: Dump LSASS via comsvcs DLL id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 -version: 7 +version: 8 date: '2024-12-10' author: Patrick Bareiss, Splunk status: production diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 56b38267ec..e1881104a9 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -1,6 +1,6 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index e001bbdc5b..6a16286298 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -1,6 +1,6 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 9 +version: 10 date: '2024-12-16' author: Teoderick Contreras, Splunk, Steven Dick status: production diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 0dbba57898..f6a5a7eec9 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -62,10 +62,11 @@ rba: type: process_name tags: analytic_story: - - XMRig - Azorult - Windows Post-Exploitation - Prestige Ransomware + - XMRig + - Crypto Stealer - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index cab5c92248..bf447f6818 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -54,8 +54,9 @@ rba: threat_objects: [] tags: analytic_story: - - Ransomware - Azorult + - Ransomware + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1569 diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 9eee049bb9..14669e1cab 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -62,12 +62,13 @@ rba: type: parent_process_name tags: analytic_story: - - XMRig - Azorult - - CISA AA22-264A - AgentTesla - CISA AA22-277A - NjRAT + - CISA AA22-264A + - XMRig + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1562.001 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 36af11563f..ead8a42979 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 6 -date: '2024-12-10' +version: 10 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -61,41 +61,46 @@ rba: type: file_name tags: analytic_story: - - Double Zero Destructor - - Graceful Wipe Out Attack - - AsyncRAT - - WhisperGate - - DarkGate Malware - - AgentTesla - - Brute Ratel C4 - - NjRAT - - RedLine Stealer - - Rhysida Ransomware - - Swift Slicer - - IcedID - - DarkCrystal RAT - Chaos Ransomware - - PlugX - - Industroyer2 - - Azorult - - Remcos - - XMRig - - Qakbot - - Volt Typhoon - - Hermetic Wiper - - Warzone RAT - Trickbot - - Amadey - - BlackByte Ransomware - - LockBit Ransomware - - CISA AA23-347A - - Data Destruction - Snake Keylogger - - AcidPour - - Handala Wiper - - MoonPeak + - CISA AA23-347A + - Industroyer2 + - WinDealer RAT + - Qakbot + - Warzone RAT + - IcedID - ValleyRAT + - Azorult + - Handala Wiper + - LockBit Ransomware - Meduza Stealer + - Brute Ratel C4 + - AsyncRAT + - AcidPour + - Derusbi + - DarkGate Malware + - Graceful Wipe Out Attack + - NjRAT + - WhisperGate + - Data Destruction + - BlackByte Ransomware + - AgentTesla + - Swift Slicer + - Crypto Stealer + - Hermetic Wiper + - MoonPeak + - Double Zero Destructor + - XMRig + - PlugX + - Amadey + - DarkCrystal RAT + - Remcos + - Nexus APT Threat Activity + - Earth Estries + - Rhysida Ransomware + - RedLine Stealer + - Volt Typhoon asset_type: Endpoint mitre_attack_id: - T1036 @@ -107,7 +112,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index d389a1626f..3c5861b898 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -1,6 +1,6 @@ name: Execute Javascript With Jscript COM CLSID id: dc64d064-d346-11eb-8588-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 306a367e2b..906eec9db6 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -1,6 +1,6 @@ name: Execution of File with Multiple Extensions id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 -version: 7 +version: 8 date: '2024-11-13' author: Rico Valdez, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 0d86b46dcd..f09d658da1 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -1,6 +1,6 @@ name: File with Samsam Extension id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf -version: 5 +version: 6 date: '2024-11-13' author: Rico Valdez, Splunk status: production diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index c60512b788..46ab4b2a2e 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,6 +1,6 @@ name: GPUpdate with no Command Line Arguments with Network id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml index a5a0e59b2d..6d6557e0ab 100644 --- a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml +++ b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml @@ -1,6 +1,6 @@ name: Headless Browser Mockbin or Mocky Request id: 94fc85a1-e55b-4265-95e1-4b66730e05c0 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 8f5a926228..c95af49a98 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -60,10 +60,11 @@ rba: threat_objects: [] tags: analytic_story: - - Windows Persistence Techniques - Azorult + - Windows Persistence Techniques - Compromised Windows Host - Windows Defense Evasion Tactics + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1222 diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 2964fb914a..2214668507 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -51,11 +51,12 @@ rba: type: process tags: analytic_story: - - Clop Ransomware - LockBit Ransomware - - BlackByte Ransomware - - Rhysida Ransomware + - Clop Ransomware - Snake Keylogger + - Rhysida Ransomware + - BlackByte Ransomware + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1486 diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index 829c399845..20178963ee 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -65,8 +65,9 @@ tags: analytic_story: - Azorult - Sandworm Tools - - XMRig - Compromised Windows Host + - XMRig + - Crypto Stealer - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 677e6de4d4..a3850db7a3 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -1,10 +1,10 @@ name: ICACLS Grant Command id: b1b1e316-accc-11eb-a9b4-acde48001122 -version: 5 -date: '2024-12-16' +version: '5' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the use of the ICACLS command to grant additional access permissions to files or directories. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process names and command-line @@ -62,8 +62,9 @@ rba: threat_objects: [] tags: analytic_story: - - XMRig - Ransomware + - Crypto Stealer + - XMRig - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 24d391c160..f5d8ed8cf8 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -16,8 +16,7 @@ description: The following analytic detects when the Kerberos Pre-Authentication data_source: - Windows Event Log Security 4738 search: > - `wineventlog_security` EventCode=4738 MSADChangedAttributes=\"*Don't Require Preauth' - - Enabled*\" |rename Account_Name as user | table EventCode, user, dest, Security_ID, + `wineventlog_security` EventCode=4738 MSADChangedAttributes="*\'Don\'t Require Preauth\' - Enabled*" |rename Account_Name as user | table EventCode, user, dest, Security_ID, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter` how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account @@ -68,3 +67,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog + diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index 7924c146e3..086b376e70 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux apt-get Privilege Escalation id: d870ce3b-e796-402f-b2af-cab4da1223f2 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index 7f6804cbfb..4466f0e3e7 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux APT Privilege Escalation id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 3dfb171bf2..8efe47b2f9 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$]. + message: A service event - [$type$] event occurred on host - [$dest$]. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index c3afef3870..a45a65d0f8 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -1,35 +1,16 @@ name: Linux Auditd Change File Owner To Root id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 version: 4 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the use of the 'chown' command to change - a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically - monitoring command-line executions and process details. This activity is significant - as it may indicate an attempt to escalate privileges by adversaries, malware, or - red teamers. If confirmed malicious, this action could allow an attacker to gain - root-level access, leading to full control over the compromised host and potential - persistence within the environment. +description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically monitoring command-line executions and process details. This activity is significant as it may indicate an attempt to escalate privileges by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as - dest | where LIKE (process_exec, "%chown %root%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_change_file_owner_to_root_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%chown %root%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_change_file_owner_to_root_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users - https://askubuntu.com/questions/617850/changing-from-user-to-superuser @@ -39,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 979500e7f3..0a32d1b5d3 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -1,36 +1,16 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the use of the Linux 'xclip' command to - copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process - names and command-line arguments related to clipboard operations. This activity - is significant because adversaries can exploit clipboard data to capture sensitive - information such as passwords or IP addresses. If confirmed malicious, this technique - could lead to unauthorized data exfiltration, compromising sensitive information - and potentially aiding further attacks within the environment. +description: The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") - OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, - "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: False positives may be present on Linux desktop as it may commonly - be used by administrators or end users. Filter as needed. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip @@ -40,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -71,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index dc43b12c00..94d554eb0a 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -1,34 +1,15 @@ name: Linux Auditd Data Destruction Command id: 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c version: 3 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of a Unix shell command - designed to wipe root directories on a Linux host. It leverages data from Linux - Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' - option. This activity is significant as it indicates potential data destruction - attempts, often associated with malware like Awfulshred. If confirmed malicious, - this behavior could lead to severe data loss, system instability, and compromised - integrity of the affected Linux host. Immediate investigation and response are crucial - to mitigate potential damage. +description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Linux Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND - LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: unknown references: - https://cert.gov.ua/article/3718487 @@ -39,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -70,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_no_preserve_root/linux_auditd_no_preserve_root.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_no_preserve_root/linux_auditd_no_preserve_root.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 33168817ae..2c7f2eee4e 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -1,35 +1,16 @@ name: Linux Auditd Data Transfer Size Limits Via Split id: 4669561d-3bbd-44e3-857c-0e3c6ef2120c version: 3 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious data transfer activities that - involve the use of the `split` syscall, potentially indicating an attempt to evade - detection by breaking large files into smaller parts. Attackers may use this technique - to bypass size-based security controls, facilitating the covert exfiltration of - sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, - this analytic helps identify potential data exfiltration attempts, allowing security - teams to intervene and prevent the unauthorized transfer of critical information - from the network. +description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats - count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -38,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -70,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_b_exec/linux_auditd_split_b_exec.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_b_exec/linux_auditd_split_b_exec.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index 6457b55aed..d9643341cb 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -1,42 +1,16 @@ name: Linux Auditd Database File And Directory Discovery id: f616c4f3-bde9-41cf-856c-019b65f668bb version: 4 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious database file and directory - discovery activities, which may signal an attacker attempt to locate and assess - critical database assets on a compromised system. This behavior is often a precursor - to data theft, unauthorized access, or privilege escalation, as attackers seek to - identify valuable information stored in databases. By monitoring for unusual or - unauthorized attempts to locate database files and directories, this analytic aids - in early detection of potential reconnaissance or data breach efforts, enabling - security teams to respond swiftly and mitigate the risk of further compromise. +description: The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, as attackers seek to identify valuable information stored in databases. By monitoring for unusual or unauthorized attempts to locate database files and directories, this analytic aids in early detection of potential reconnaissance or data breach efforts, enabling security teams to respond swiftly and mitigate the risk of further compromise. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, - "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR - LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, - "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE - (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR - LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, - "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -46,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -79,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_db/linux_auditd_find_db.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_db/linux_auditd_find_db.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 9a5ee1f5fe..5dfd17febc 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] to disable or modify system firewall occured + message: A service event - [$type$] to disable or modify system firewall occurred on host - [$dest$] . risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 16fccb7a70..6eea3f2bdf 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event occured on host - [$dest$] to create a doas.conf file. + message: A [$type$] event occurred on host - [$dest$] to create a doas.conf file. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 52a86aa342..f117d9113f 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -1,46 +1,16 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 3 -date: '2024-11-13' +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious file and directory discovery - activities, which may indicate an attacker's effort to locate sensitive documents - and files on a compromised system. This behavior often precedes data exfiltration, - as adversaries seek to identify valuable or confidential information for theft. - By identifying unusual or unauthorized attempts to browse or enumerate files and - directories, this analytic helps security teams detect potential reconnaissance - or preparatory actions by an attacker, enabling timely intervention to prevent data - breaches or unauthorized access. +description: The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and directories, this analytic helps security teams detect potential reconnaissance or preparatory actions by an attacker, enabling timely intervention to prevent data breaches or unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, - "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE - (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, - "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE - (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR - LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, - "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE - (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, - "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE - (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, - "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats - count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -50,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -83,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_document/linux_auditd_find_document.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_document/linux_auditd_find_document.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index f1a05daa1a..f33b95fed5 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -1,8 +1,8 @@ name: Linux Auditd File Permission Modification Via Chmod id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 -version: 5 -date: '2024-12-19' -author: Teoderick Contreras, Splunk, Ivar Nygård +version: 6 +date: '2025-01-27' +author: "Teoderick Contreras, Splunk, Ivar Nyg\xE5rd" status: production type: Anomaly description: The following analytic detects suspicious file permission modifications @@ -22,9 +22,9 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename hos max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permission_modification_via_chmod_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures + command-line executions and process details on Unix/Linux systems. These logs should + be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources @@ -58,11 +58,13 @@ rba: threat_objects: [] tags: analytic_story: - - XorDDos + - Linux Privilege Escalation - Linux Living Off The Land - Compromised Linux Host - - Linux Privilege Escalation - Linux Persistence Techniques + - XorDDos + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1222.002 @@ -75,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 3618f2cc1d..84bb8beef4 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,36 +1,16 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file permissions modifications - using the chattr command, which may indicate an attacker attempting to manipulate - file attributes to evade detection or prevent alteration. The chattr command can - be used to make files immutable or restrict deletion, which can be leveraged to - protect malicious files or disrupt system operations. By monitoring for unusual - or unauthorized chattr usage, this analytic helps identify potential tampering with - critical files, enabling security teams to quickly respond to and mitigate threats - associated with unauthorized file attribute changes. +description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host - as dest | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") - | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle - normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_file_permissions_modification_via_chattr_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -39,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chattr_i/linux_auditd_chattr_i.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 2a345f75c0..f42a173862 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,42 +1,16 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find credentials - stored in password managers, which may indicate an attacker's effort to retrieve - sensitive login information. Password managers are often targeted by adversaries - seeking to access stored passwords for further compromise or lateral movement within - a network. By monitoring for unusual or unauthorized access to password manager - files or processes, this analytic helps identify potential credential theft attempts, - enabling security teams to respond quickly to protect critical accounts and prevent - further unauthorized access. +description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, - "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR - LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE - (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, - "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR - LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, - "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_find_credentials_from_password_managers_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -46,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -80,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_password_db/linux_auditd_find_password_db.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 09ff7a6107..6332592a94 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -1,37 +1,16 @@ name: Linux Auditd Find Credentials From Password Stores id: 4de73044-9a1d-4a51-a1c2-85267d8dcab3 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious attempts to find credentials - stored in password stores, indicating a potential attacker's effort to access sensitive - login information. Password stores are critical repositories that contain valuable - credentials, and unauthorized access to them can lead to significant security breaches. - By monitoring for unusual or unauthorized activities related to password store access, - this analytic helps identify potential credential theft attempts, allowing security - teams to respond promptly and prevent unauthorized access to critical systems and - data. +description: The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, - "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -41,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -75,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_credentials/linux_auditd_find_credentials.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.005/linux_auditd_find_credentials/linux_auditd_find_credentials.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 1df35fe233..8788828cc2 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -1,38 +1,16 @@ name: Linux Auditd Find Ssh Private Keys id: e2d2bd10-dcd1-4b2f-8a76-0198eab32ba5 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious attempts to find SSH private - keys, which may indicate an attacker's effort to compromise secure access to systems. - SSH private keys are essential for secure authentication, and unauthorized access - to these keys can enable attackers to gain unauthorized access to servers and other - critical infrastructure. By monitoring for unusual or unauthorized searches for - SSH private keys, this analytic helps identify potential threats to network security, - allowing security teams to quickly respond and safeguard against unauthorized access - and potential breaches. +description: The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, - "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_find_ssh_private_keys_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -42,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -76,7 +49,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_ssh_files/linux_auditd_find_ssh_files.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_ssh_files/linux_auditd_find_ssh_files.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index 8c3b6a60df..11a767918e 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -1,36 +1,16 @@ name: Linux Auditd Hardware Addition Swapoff id: 5728bb16-1a0b-4b66-bce2-0074ac839770 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the "swapoff" command, - which disables the swapping of paging devices on a Linux system. It leverages data - from Endpoint Detection and Response (EDR) agents, focusing on process execution - logs. This activity is significant because disabling swap can be a tactic used by - malware, such as Awfulshred, to evade detection and hinder forensic analysis. If - confirmed malicious, this action could allow an attacker to manipulate system memory - management, potentially leading to data corruption, system instability, or evasion - of memory-based detection mechanisms. +description: The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host - as dest | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") - | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle - normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_hardware_addition_swapoff_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: administrator may disable swapping of devices in a linux host. - Filter is needed. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed. references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ drilldown_searches: @@ -39,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -71,7 +46,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 524c1ae9b6..f888933bba 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,39 +1,16 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 version: 4 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious creation of hidden files and - directories, which may indicate an attacker's attempt to conceal malicious activities - or unauthorized data. Hidden files and directories are often used to evade detection - by security tools and administrators, providing a stealthy means for storing malware, - logs, or sensitive information. By monitoring for unusual or unauthorized creation - of hidden files and directories, this analytic helps identify potential attempts - to hide or unauthorized creation of hidden files and directories, this analytic - helps identify potential attempts to hide malicious operations, enabling security - teams to uncover and address hidden threats effectively. +description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR - LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano - %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," - /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_hidden_files_and_directories_creation_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -43,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -75,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_hidden_file/linux_auditd_hidden_file.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index 2bb1184ab4..10a1cc21ad 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -19,7 +19,7 @@ search: '`linux_auditd` type=SYSCALL comm=insmod | rename host as dest | stats c success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_insert_kernel_module_using_insmod_utility_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 1769ff5a99..29a1db8488 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -1,34 +1,16 @@ name: Linux Auditd Install Kernel Module Using Modprobe Utility id: 95165985-ace5-4d42-9c42-93a89a5af901 version: 3 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the installation of a Linux kernel module - using the modprobe utility. It leverages data from Linux Auditd, focusing on process - names and command-line executions. This activity is significant because installing - a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level - code, potentially leading to elevated privileges and bypassing security detections. - If confirmed malicious, this could allow an attacker to gain persistent, high-level - access to the system, compromising its integrity and security. +description: The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count - min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid - success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup @@ -39,12 +21,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +50,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index 5509cdeda0..266495693a 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -19,7 +19,7 @@ search: '`linux_auditd` type=SYSCALL comm=lsmod | rename host as dest | stats c success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_enumeration_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 2f6788506b..b0d9f8aa6c 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,8 +58,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index a4aac2cbcf..edf2a44c84 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop the + message: A service event - [$type$] event occurred on host - [$dest$] to stop the osquery service. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index ce1805c364..499e0a23bb 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -60,8 +60,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1003.008 @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 89197c710b..8dda7e5e89 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,8 +57,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -71,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 83544e6fb9..d80e3059c5 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 version: 4 -date: '2024-12-17' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -19,7 +19,7 @@ search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", " by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index f793396217..fdfa38e184 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 -version: 3 -date: '2024-11-13' +version: 4 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,13 +16,14 @@ description: The following analytic detects the use of the LD_PRELOAD environmen data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime - max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' + dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, + "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc + process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_preload_hijack_library_calls_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures + command-line executions and process details on Unix/Linux systems. These logs should + be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources @@ -57,8 +58,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.006 @@ -71,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 1090b25606..2d5b8c3d5e 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event has occured on host - [$dest$] to modify the preload file. + message: A [$type$] event has occurred on host - [$dest$] to modify the preload file. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml new file mode 100644 index 0000000000..29d3189d49 --- /dev/null +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -0,0 +1,53 @@ +name: Linux Auditd Private Keys and Certificate Enumeration +id: 892eb674-3344-4143-8e52-4775b1daf3f1 +version: 1 +date: '2025-01-15' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%") OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_private_keys_and_certificate_enumeration_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] +tags: + analytic_story: + - Linux Living Off The Land + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host + asset_type: Endpoint + mitre_attack_id: + - T1552.004 + - T1552 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index 5a1fbb58cb..df8cc3f4ae 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -1,37 +1,16 @@ name: Linux Auditd Setuid Using Setcap Utility id: 1474459a-302b-4255-8add-d82f96d14cd9 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of the 'setcap' utility - to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing - on process names and command-line arguments that indicate the use of 'setcap' with - specific capabilities. This activity is significant because setting the SUID bit - allows a user to temporarily gain root access, posing a substantial security risk. - If confirmed malicious, an attacker could escalate privileges, execute arbitrary - commands with elevated permissions, and potentially compromise the entire system. +description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute arbitrary commands with elevated permissions, and potentially compromise the entire system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep - %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p - %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep - %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_setuid_using_setcap_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ drilldown_searches: @@ -40,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setcap_priv.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setcap_priv.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 3715e29558..23004f47e1 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,34 +1,16 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 3 -date: '2024-11-13' +date: '2024-12-16' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects attempts to stop or clear a service on - Linux systems. It leverages data from Linux Auditd, focusing on processes like "systemctl," - "service," and "svcadm" executing stop commands. This activity is significant as - adversaries often terminate security or critical services to disable defenses or - disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, - this could lead to the disabling of security mechanisms, allowing attackers to persist, - escalate privileges, or deploy destructive payloads, severely impacting system integrity - and availability. +type: Hunting +description: The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) - as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 @@ -38,22 +20,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop or - disable a service. - risk_objects: - - field: dest - type: system - score: 49 - threat_objects: [] tags: analytic_story: - Industroyer2 @@ -71,7 +40,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_service_stop/linux_auditd_service_stop.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index 02888ee53f..b53ed7ef6c 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -1,35 +1,16 @@ name: Linux Auditd Sudo Or Su Execution id: 817a5c89-5b92-4818-a22d-aa35e1361afe version: 3 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the "sudo" or "su" command - on a Linux operating system. It leverages data from Linux Auditd, focusing on process - names and parent process names. This activity is significant because "sudo" and - "su" commands are commonly used by adversaries to elevate privileges, potentially - leading to unauthorized access or control over the system. If confirmed malicious, - this activity could allow attackers to execute commands with root privileges, leading - to severe security breaches, data exfiltration, or further system compromise. +description: The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. It leverages data from Linux Auditd, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute commands with root privileges, leading to severe security breaches, data exfiltration, or further system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host - as dest | where LIKE(process_exec, "%sudo %") OR LIKE(process_exec, "%su %") | stats - count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_sudo_or_su_execution_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/003/ drilldown_searches: @@ -38,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -71,7 +47,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudo_su/linux_auditd_sudo_su.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index fd87cbaabc..64021b8def 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop or + message: A service event - [$type$] event occurred on host - [$dest$] to stop or disable the sysmon service. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 43a4fbf7f8..50d90725bc 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -53,7 +53,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event occured on host - [$dest$] to modify the unix shell configuration + message: A [$type$] event occurred on host - [$dest$] to modify the unix shell configuration file. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 615a6e7e2b..d3f5d76e2e 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -1,36 +1,16 @@ name: Linux Auditd Unload Module Via Modprobe id: 90964d6a-4b5f-409a-85bd-95e261e03fe9 version: 3 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious use of the `modprobe` command - to unload kernel modules, which may indicate an attempt to disable critical system - components or evade detection. The `modprobe` utility manages kernel modules, and - unauthorized unloading of modules can disrupt system security features, remove logging - capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized - `modprobe` operations involving module unloading, this analytic helps identify potential - tampering with kernel functionality, enabling security teams to investigate and - address possible threats to system integrity. +description: The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, enabling security teams to investigate and address possible threats to system integrity. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") - | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec - dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_unload_module_via_modprobe_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -39,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe_unload_module/linux_auditd_modprobe_unload_module.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe_unload_module/linux_auditd_modprobe_unload_module.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index edf0906fc8..59da2a56d4 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -1,37 +1,16 @@ name: Linux Auditd Virtual Disk File And Directory Discovery id: eec78cef-d4c8-4b35-8f5b-6922102a4a41 version: 4 -date: '2024-11-13' +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious discovery of virtual disk files - and directories, which may indicate an attacker's attempt to locate and access virtualized - storage environments. Virtual disks can contain sensitive data or critical system - configurations, and unauthorized discovery attempts could signify preparatory actions - for data exfiltration or further compromise. By monitoring for unusual or unauthorized - searches for virtual disk files and directories, this analytic helps identify potential - reconnaissance activities, enabling security teams to respond promptly and safeguard - against unauthorized access and data breaches. +description: The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring for unusual or unauthorized searches for virtual disk files and directories, this analytic helps identify potential reconnaissance activities, enabling security teams to respond promptly and safeguard against unauthorized access and data breaches. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as - dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND - (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, - "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc - process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application - for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -41,12 +20,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -74,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_virtual_disk/linux_auditd_find_virtual_disk.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/linux_auditd_find_virtual_disk/linux_auditd_find_virtual_disk.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index 1036c94106..f7a4f975d6 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux AWK Privilege Escalation id: 4510cae0-96a2-4840-9919-91d262db210a -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index f6bbd0bde7..4f7d70ec4a 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Busybox Privilege Escalation id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index 3919b610e8..9e9c19688c 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux c89 Privilege Escalation id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 9e76c91bfe..2b4cc5888a 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux c99 Privilege Escalation id: e1c6dec5-2249-442d-a1f9-99a4bd228183 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index 76739b4d0c..9bcb78b36d 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -1,7 +1,7 @@ name: Linux Common Process For Elevation Control id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -45,8 +45,10 @@ references: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Linux Living Off The Land + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.001 @@ -59,7 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index 4128c46843..5753643b61 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Composer Privilege Escalation id: a3bddf71-6ba3-42ab-a6b2-396929b16d92 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index 2d565e6a8b..655e36cbef 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Cpulimit Privilege Escalation id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index 0b4a4ed4b6..ed76fcb05a 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Csvtool Privilege Escalation id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml index 0ed0562b5d..d995933ae4 100644 --- a/detections/endpoint/linux_data_destruction_command.yml +++ b/detections/endpoint/linux_data_destruction_command.yml @@ -1,6 +1,6 @@ name: Linux Data Destruction Command id: b11d3979-b2f7-411b-bb1a-bd00e642173b -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index a60cd9db88..a332d7535a 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -1,6 +1,6 @@ name: Linux Decode Base64 to Shell id: 637b603e-1799-40fd-bf87-47ecbd551b66 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index a6c8d07606..5b3c7f3d26 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Docker Privilege Escalation id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index 2e3b916845..1bdef39406 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Emacs Privilege Escalation id: 92033cab-1871-483d-a03b-a7ce98665cfc -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index e5c714cbed..810914e4f3 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -1,7 +1,7 @@ name: Linux File Creation In Init Boot Directory id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -version: 5 -date: '2024-12-19' +version: 6 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,9 +49,11 @@ rba: threat_objects: [] tags: analytic_story: + - Linux Privilege Escalation + - Backdoor Pingpong - Linux Persistence Techniques - XorDDos - - Linux Privilege Escalation + - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1037.004 @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index faeeb076e0..ea4a8f3b0d 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Find Privilege Escalation id: 2ff4e0c2-8256-4143-9c07-1e39c7231111 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index fd91250e3a..3e0b7e05d0 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux GDB Privilege Escalation id: 310b7da2-ab52-437f-b1bf-0bd458674308 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index 7976f81781..848b8f393f 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Gem Privilege Escalation id: 0115482a-5dcb-4bb0-bcca-5d095d224236 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 818ca801e4..f7fc077d77 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux GNU Awk Privilege Escalation id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 40089e9a41..3107d907e2 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -67,6 +67,8 @@ rba: tags: analytic_story: - Sandworm Tools + - Backdoor Pingpong + - Nexus APT Threat Activity - Cyclops Blink asset_type: Endpoint mitre_attack_id: @@ -80,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index 4625c20fb7..a13f0d306e 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -1,6 +1,6 @@ name: Linux Java Spawning Shell id: 7b09db8a-5c20-11ec-9945-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 9939c3de7c..157f255449 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -1,6 +1,6 @@ name: Linux Kernel Module Enumeration id: 6df99886-0e04-4c11-8b88-325747419278 -version: 6 +version: 7 date: '2024-11-17' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index a8e87a9bf6..9d81cbaa3d 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Make Privilege Escalation id: 80b22836-5091-4944-80ee-f733ac443f4f -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index 370c6cc5e1..77ade04a7d 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux MySQL Privilege Escalation id: c0d810f4-230c-44ea-b703-989da02ff145 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml index eeaf7de9e4..ace58aa7ad 100644 --- a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml @@ -1,6 +1,6 @@ name: Linux Ngrok Reverse Proxy Usage id: bc84d574-708c-467d-b78a-4c1e20171f97 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index 5e26a21d55..09569d3dd1 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Node Privilege Escalation id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 57cecb4c36..15ca07070f 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux NOPASSWD Entry In Sudoers File id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -59,6 +59,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index 033284562b..eeb2fe21ba 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -1,6 +1,6 @@ name: Linux Obfuscated Files or Information Base64 Decode id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index 37839dd3cb..748265ca07 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Octave Privilege Escalation id: 78f7487d-42ce-4f7f-8685-2159b25fb477 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index 452799d717..dac490faf9 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux OpenVPN Privilege Escalation id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml index 3fd5724dd5..5062079c03 100644 --- a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml +++ b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml @@ -29,9 +29,9 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 | `linux_persistence_and_privilege_escalation_risk_behavior_filter`' how_to_implement: Ensure Linux anomaly and TTP analytics are enabled. TTP may be set - to Notables for point detections, anomaly should not be notables but risk generators. + to finding for point detections, anomaly should not be findings but risk generators. The correlation relies on more than x amount of distict detection names generated - before generating a notable. Modify the value as needed. Default value is set to + before generating a finding. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment. known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers. diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index 521ece7f21..4ca46b1699 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux PHP Privilege Escalation id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml index e4fa7129d7..81844e155e 100644 --- a/detections/endpoint/linux_pkexec_privilege_escalation.yml +++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux pkexec Privilege Escalation id: 03e22c1c-8086-11ec-ac2e-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index cf66f3b765..e5f2c33dce 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Credential Files id: 16107e0e-71fc-11ec-b862-acde48001122 -version: 5 -date: '2024-12-19' +version: 6 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,9 +57,11 @@ rba: threat_objects: [] tags: analytic_story: + - Linux Privilege Escalation - Linux Persistence Techniques - XorDDos - - Linux Privilege Escalation + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1003.008 @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index e23d63ea29..2be5685254 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Sudoers File id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -71,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index e5f075a774..9ad2401c00 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Preload Hijack Library Calls id: cbe2ca30-631e-11ec-8670-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -58,6 +58,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -71,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml index 1093bc6413..2501295d79 100644 --- a/detections/endpoint/linux_proxy_socks_curl.yml +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -1,6 +1,6 @@ name: Linux Proxy Socks Curl id: bd596c22-ad1e-44fc-b242-817253ce8b08 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index 05c7c3d735..ee0c832bfc 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Puppet Privilege Escalation id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index 612f08ab5f..1535df3087 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux RPM Privilege Escalation id: f8e58a23-cecd-495f-9c65-6c76b4cb9774 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index b004b42783..340e46c341 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Ruby Privilege Escalation id: 097b28b5-7004-4d40-a715-7e390501788b -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index 60c9288b4e..dd00c643bd 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Sqlite3 Privilege Escalation id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index a2a4c09110..d513ccb7c5 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -1,6 +1,6 @@ name: Linux SSH Authorized Keys Modification id: f5ab595e-28e5-4327-8077-5008ba97c850 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 6fcbed4dcd..cddd81fa59 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -1,6 +1,6 @@ name: Linux SSH Remote Services Script Execute id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index 71b5a42aaf..838f432cab 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Sudoers Tmp File Creation id: be254a5c-63e7-11ec-89da-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 239f96d4ff..23f7cc2670 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -43,17 +43,18 @@ references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - NOBELIUM Group - - WhisperGate - - DarkCrystal RAT - - Qakbot - CISA AA22-320A + - Hermetic Wiper - Sandworm Tools - - Data Destruction + - Qakbot - Volt Typhoon + - NOBELIUM Group + - Data Destruction - Lumma Stealer + - Malicious PowerShell + - DarkCrystal RAT + - WhisperGate + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1027 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 2a21d1b26f..228765bed3 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,10 +1,10 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: 8 -date: '2024-11-13' +version: 9 +date: '2025-01-27' author: Rico Valdez, Mauricio Velazco, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects PowerShell processes initiated with parameters that bypass the local execution policy for scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing @@ -20,8 +20,8 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_powershell` (Processes.process="* -ex*" OR Processes.process="* bypass - *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` + where `process_powershell` (Processes.process="* -ex*" AND Processes.process="* + bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related @@ -61,9 +61,11 @@ rba: tags: analytic_story: - DHS Report TA18-074A - - HAFNIUM Group - - DarkCrystal RAT - AsyncRAT + - DarkCrystal RAT + - HAFNIUM Group + - Nexus APT Threat Activity + - Earth Estries - Volt Typhoon asset_type: Endpoint mitre_attack_id: @@ -77,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index eb9a570618..eba3aaecd3 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -1,54 +1,22 @@ name: Microsoft Defender ATP Alerts id: 38f034ed-1598-46c8-95e8-14edf05fdf5d -version: 2 -date: '2025-01-21' +version: 3 +date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production type: TTP data_source: - MS Defender ATP Alerts -description: The following analytic is to leverage alerts from Microsoft Defender - ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender - ATP Alerts, providing details such as the source, file name, severity, process command - line, ip address, registry key, signature, description, unique id, and timestamps. - This detection is not intended to detect new activity from raw data, but leverages - Microsoft provided alerts to be correlated with other data as part of risk based - alerting. The data contained in the alert is mapped not only to the risk obejct, - but also the threat object. This detection filters out evidence that has a verdict - of clean from Microsoft. It dynamically maps the MITRE technique at search time - to auto populate the annotation field with the value provided in the alert. It also - uses a dynamic mapping to set the risk score in Enterprise Security based on the - severity of the alert. -search: ' `ms_defender_atp_alerts` (dest=* OR user=*)| eval tmp_evidence=json_extract(_raw, - "evidence"), tmp_evidencemv=json_array_to_mv(tmp_evidence), entityType = mvmap(tmp_evidencemv, - spath(tmp_evidencemv, "entityType")), filePath = mvmap(tmp_evidencemv, spath(tmp_evidencemv, - "filePath")), processCommandLine = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "processCommandLine")), - ipAddress = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "ipAddress")), registryKey - = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "registryKey")), url = mvmap(tmp_evidencemv, - spath(tmp_evidencemv, "url")), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, - "fileName")) | eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, "entityType") - = "File"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) | - eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", - 25, severity="high", 50 , true(), 2) | eval processCommandLine=if(processCommandLine="null", - "", processCommandLine), ipAddress=if(ipAddress="null", "", ipAddress), registryKey=if(registryKey="null", - "", registryKey), url=if(url="null", "", url) | stats count min(_time) as firstTime - max(_time) as lastTime values(fileName) as file_name values(severity) as severity - values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) - as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id - values(signature) as signature values(user) as user values(risk_score) as risk_score - by id description src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `microsoft_defender_atp_alerts_filter`' -how_to_implement: In order to properly run this search, you need to ingest alerts - data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft - Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. - You will need to define the `ms_defender_atp_alerts` macro to point to the proper - index that contains the ms:defender:atp:alerts sourcetype. **NOTE** - We also have - a detection named `Detect Critical Alerts from Security Tools` that triggers on - the same data and is written against the Alerts datamodel. Enabling both of these - detections will result in duplicate risk/notable events, we recommend enabling only - one of these detections. -known_false_positives: False positives may vary based on Microsfot Defender configuration; - monitor and filter out the alerts that are not relevant to your environment. +description: The following analytic is to leverage alerts from Microsoft Defender ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender ATP Alerts, providing details such as the source, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk obejct, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a dynamic mapping to set the risk score in Enterprise Security based on the severity of the alert. +search: ' `ms_defender_atp_alerts` (dest=* OR user=*)| eval tmp_evidence=json_extract(_raw, "evidence"), tmp_evidencemv=json_array_to_mv(tmp_evidence), entityType = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "entityType")), filePath = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "filePath")), processCommandLine = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "processCommandLine")), ipAddress = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "ipAddress")), registryKey = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "registryKey")), url = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "url")), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) +| eval tmp_evidencemv=mvfilter(json_extract(tmp_evidencemv, "entityType") = "File"), fileName = mvmap(tmp_evidencemv, spath(tmp_evidencemv, "fileName")) +| eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50 , true(), 2) +| eval processCommandLine=if(processCommandLine="null", "", processCommandLine), ipAddress=if(ipAddress="null", "", ipAddress), registryKey=if(registryKey="null", "", registryKey), url=if(url="null", "", url) +| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description src +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `microsoft_defender_atp_alerts_filter`' +how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype. +known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide - https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0 @@ -60,12 +28,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -99,15 +62,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - manual_test: We are dynamically creating the risk_score field based on the severity - of the alert in the SPL and that supersedes the risk score set in the detection. - Setting these to manual test since otherwise we fail integration testing. The - detection is also failing on unit-testing as some of the fields set in the observables - are empty. + manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty. tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event.log source: ms_defender_atp_alerts sourcetype: ms:defender:atp:alerts diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index 0b648b1ec0..4cae1ede0f 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -1,52 +1,28 @@ name: Microsoft Defender Incident Alerts id: 13435b55-afd8-46d4-9045-7d5457f430a5 -version: 2 -date: '2025-01-21' +version: 3 +date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production type: TTP data_source: - MS365 Defender Incident Alerts -description: The following analytic is to leverage alerts from Microsoft Defender - O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender - O365 Incidents, providing details such as the destination, file name, severity, - process command line, ip address, registry key, signature, description, unique id, - and timestamps. This detection is not intended to detect new activity from raw data, - but leverages Microsoft provided alerts to be correlated with other data as part - of risk based alerting. The data contained in the alert is mapped not only to the - risk obejct, but also the threat object. This detection filters out evidence that - has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at - search time to auto populate the annotation field with the value provided in the - alert. It also uses a static mapping to set the risk score based on the severity - of the alert. -search: '`ms365_defender_incident_alerts` (dest=* OR user=*) | eval tmp_entities=json_extract(_raw, - "entities"), tmp_entitymv=json_array_to_mv(tmp_entities), tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, - "verdict") != "Clean"), entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, - "entityType")), filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "filePath")), - processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "processCommandLine")), - ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "ipAddress")), registryKey - = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "registryKey")), url = mvmap(tmp_filtered_mv, - spath(tmp_filtered_mv, "url")) | eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, - "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, - "fileName")) | eval risk_score=case(severity="informational", 5, severity="low", - 15, severity="medium", 25, severity="high", 50, true(), 2) | stats count min(_time) - as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) - as severity values(processCommandLine) as process values(ipAddress) as ip_address - values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) - as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) - as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`' -how_to_implement: In order to properly run this search, you need to ingest alerts - data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot - Security. This add-on will collect alerts using the ms365:defender:incident:alerts - sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to - point to the proper index that contains the ms365:defender:incident:alerts sourcetype. - **NOTE** - We also have a detection named `Detect Critical Alerts from Security - Tools` that triggers on the same data and is written against the Alerts datamodel. - Enabling both of these detections will result in duplicate risk/notable events, - we recommend enabling only one of these detections. -known_false_positives: False positives may vary based on Microsfot Defender configuration; - monitor and filter out the alerts that are not relevant to your environment. +description: The following analytic is to leverage alerts from Microsoft Defender O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender O365 Incidents, providing details such as the destination, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk obejct, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a static mapping to set the risk score based on the severity of the alert. +search: '`ms365_defender_incident_alerts` (dest=* OR user=*) +| eval tmp_entities=json_extract(_raw, "entities"), +tmp_entitymv=json_array_to_mv(tmp_entities), +tmp_filtered_mv=mvfilter(json_extract(tmp_entitymv, "verdict") != "Clean"), +entityType = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "entityType")), +filePath = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "filePath")), +processCommandLine = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "processCommandLine")), +ipAddress = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "ipAddress")), +registryKey = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "registryKey")), +url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "url")) +| eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "fileName")) +| eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50, true(), 2) +| stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`' +how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype. +known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide - https://learn.microsoft.com/en-us/graph/api/resources/security-alert?view=graph-rest-1.0 @@ -58,12 +34,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -97,15 +68,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint - manual_test: We are dynamically creating the risk_score field based on the severity - of the alert in the SPL and that supersedes the risk score set in the detection. - Setting these to manual test since otherwise we fail integration testing. The - detection is also failing on unit-testing as some of the fields set in the observables - are empty. + manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty. tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event.log source: m365_defender_incident_alerts sourcetype: ms365:defender:incident:alerts diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index a7e6d21079..247e54e6b3 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -6,12 +6,13 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the modification of ACL permissions to - files or folders, making them accessible to everyone. It leverages data from Endpoint - Detection and Response (EDR) agents, focusing on processes like "cacls.exe," "icacls.exe," - and "xcacls.exe" with specific command-line arguments. This activity is significant - as it may indicate an adversary attempting to evade ACLs or access protected files. - If confirmed malicious, this could allow unauthorized access to sensitive data, - potentially leading to data breaches or further system compromise. + files or folders, making them accessible to everyone or to system account. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on processes like + "cacls.exe," "icacls.exe," and "xcacls.exe" with specific command-line arguments. + This activity is significant as it may indicate an adversary attempting to evade + ACLs or access protected files. If confirmed malicious, this could allow unauthorized + access to sensitive data, potentially leading to data breaches or further system + compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 @@ -59,6 +60,7 @@ rba: threat_objects: [] tags: analytic_story: + - Crypto Stealer - XMRig - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 904d7c0ff7..1d9de05366 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -1,6 +1,6 @@ name: Mshta spawning Rundll32 OR Regsvr32 Process id: 4aa5d062-e893-11eb-9eb2-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 39954eb225..fa4c8d036a 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,7 +1,7 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 5 -date: '2024-11-13' +version: 6 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,17 +49,19 @@ rba: threat_objects: [] tags: analytic_story: - - Remcos - - NjRAT - - Warzone RAT + - Snake Keylogger + - CISA AA23-347A - 3CX Supply Chain Attack - - RedLine Stealer + - Warzone RAT + - Remcos + - AgentTesla + - Phemedrone Stealer - FIN7 - DarkGate Malware - - AgentTesla - - CISA AA23-347A - - Phemedrone Stealer - - Snake Keylogger + - Nexus APT Threat Activity + - Earth Estries + - NjRAT + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1555 @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml index 1b8e50b748..9598488359 100644 --- a/detections/endpoint/notepad_with_no_command_line_arguments.yml +++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Notepad with no Command Line Arguments id: 5adbc5f1-9a2f-41c1-a810-f37e015f8179 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 4d45a2bdcb..8beee2753c 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -62,8 +62,9 @@ rba: type: process_name tags: analytic_story: - - Ransomware - Sandworm Tools + - Ransomware + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1222 diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml new file mode 100644 index 0000000000..7939bcde78 --- /dev/null +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -0,0 +1,58 @@ +name: Potential System Network Configuration Discovery Activity +id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5 +version: 2 +date: '2025-01-20' +author: Bhavin Patel, Splunk +status: production +type: Anomaly +description: The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity can be significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.parent_process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process parent_process_name eventcount | `potential_system_network_configuration_discovery_activity_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. +references: [] +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning multiple $process_name$ was + identified on endpoint $dest$ by user $user$ typically not a normal behavior of + the process. + risk_objects: + - field: user + type: user + score: 32 + - field: dest + type: system + score: 32 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + mitre_attack_id: + - T1016 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 34677f910e..bdf4328edc 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 9 -date: '2024-12-16' +version: 10 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: Hunting @@ -59,17 +59,19 @@ references: - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ tags: analytic_story: - - Malicious PowerShell - - Hermetic Wiper - - Rhysida Ransomware - - DarkGate Malware + - Data Destruction - Flax Typhoon - CISA AA23-347A - - Data Destruction - - CISA AA24-241A - Braodo Stealer - - Lumma Stealer - Cleo File Transfer Software + - Malicious PowerShell + - Hermetic Wiper + - DarkGate Malware + - Lumma Stealer + - Nexus APT Threat Activity + - Earth Estries + - Rhysida Ransomware + - CISA AA24-241A asset_type: Endpoint mitre_attack_id: - T1059 @@ -82,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_load_module_in_meterpreter.yml b/detections/endpoint/powershell_load_module_in_meterpreter.yml index de6090bb3f..7f8f0917d4 100644 --- a/detections/endpoint/powershell_load_module_in_meterpreter.yml +++ b/detections/endpoint/powershell_load_module_in_meterpreter.yml @@ -1,6 +1,6 @@ name: Powershell Load Module in Meterpreter id: d5905da5-d050-48db-9259-018d8f034fcf -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index dd5384ca2c..8c3ae5d352 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,29 +1,16 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 6 -date: '2024-11-13' +version: 7 +date: '2025-01-16' author: Michael Haag, Splunk status: production -type: TTP +type: Anomaly data_source: - Powershell Script Block Logging 4104 -description: The following analytic detects the use of PowerShell to load .NET assemblies - into memory via reflection, a technique often used in malicious activities such - as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging - (EventCode=4104) to capture and analyze the full command executed. This behavior - is significant as it can indicate advanced attack techniques aiming to execute code - in memory, bypassing traditional defenses. If confirmed malicious, this activity - could lead to unauthorized code execution, privilege escalation, and persistent - access within the environment. -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", - "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime - by Opcode Computer UserID EventCode ScriptBlockText | rename UserID as user | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' -how_to_implement: To successfully implement this analytic, you will need to enable - PowerShell Script Block Logging on some or all endpoints. Additional setup here - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: False positives should be limited as day to day scripts do - not use this method. +description: The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*", "*Reflection.Assembly.Load*", "*UnsafeLoadFrom*", "*.LoadFrom(*", "*.LoadModule(*", "*.LoadWithPartialName*", "*ReflectionOnlyLoad*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited as day to day scripts do not use this method. references: - https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0 - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -31,25 +18,20 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$Computer$" and "$user$" - search: '%original_detection_search% | search Computer = "$Computer$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", - "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in - host $Computer$ + host $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 56 - field: user @@ -76,7 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 24967a1f8b..3f4244f0ca 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,6 +1,6 @@ name: Powershell Processing Stream Of Data id: 0d718b52-c9f1-11eb-bc61-acde48001122 -version: 6 +version: 7 date: '2024-11-22' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 6f0ea6b1e1..118090ab0d 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -1,6 +1,6 @@ name: Powershell Remove Windows Defender Directory id: adf47620-79fa-11ec-b248-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 104e8afe41..6b50ec5b4f 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -1,6 +1,6 @@ name: PowerShell Start-BitsTransfer id: 39e2605a-90d8-11eb-899e-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index 01a0fa23c4..4779e1c10c 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -23,7 +23,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: This behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. Therefore, - it is recommended not to enable this analytic as a direct notable or TTP. Instead, + it is recommended not to enable this analytic as a direct finding Instead, it should be used as part of a broader set of security controls to detect and investigate potential threats. references: diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index 0bac5ac032..06ea69848f 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -1,6 +1,6 @@ name: Prevent Automatic Repair Mode using Bcdedit id: 7742aa92-c9d9-11eb-bbfc-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 40f522d2cb..5e37c7894e 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -43,7 +43,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ + message: Suspicious printer spooler errors have occurred on endpoint $ComputerName$ with EventCode $EventCode$. risk_objects: - field: ComputerName diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 22d03dda5e..bb4f8eb862 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -1,6 +1,6 @@ name: Process Kill Base On File Path id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 15539d184d..b217c5d2a0 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -1,6 +1,6 @@ name: Recon AVProduct Through Pwh or WMI id: 28077620-c9f6-11eb-8785-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index f11cc03166..033abc60c4 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -1,6 +1,6 @@ name: Reg exe Manipulating Windows Services Registry Keys id: 8470d755-0c13-45b3-bd63-387a373c10cf -version: 8 +version: 9 date: '2024-11-13' author: Rico Valdez, Splunk status: production diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 7d20f02115..ab697057ee 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -1,6 +1,6 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 10 +version: 11 date: '2024-12-08' author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d8633a87fa..9f542cbcf2 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 13 -date: '2024-12-16' +version: 15 +date: '2025-01-27' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -77,32 +77,35 @@ rba: threat_objects: [] tags: analytic_story: - - AsyncRAT - - Ransomware + - Chaos Ransomware - Windows Persistence Techniques + - DHS Report TA18-074A + - Snake Keylogger + - CISA AA23-347A + - WinDealer RAT + - Qakbot + - Warzone RAT + - IcedID + - Azorult + - Suspicious Windows Registry Activities + - AsyncRAT + - Derusbi + - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - DarkGate Malware - NjRAT - - RedLine Stealer - - IcedID - - Sneaky Active Directory Persistence Tricks - - Chaos Ransomware - - Azorult - - DHS Report TA18-074A - - Emotet Malware DHS Report TA18-201A - - Remcos - - Windows Registry Abuse - - Qakbot - - Suspicious MSHTA Activity - - Suspicious Windows Registry Activities - - Warzone RAT - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Amadey - BlackByte Ransomware - - CISA AA23-347A - - Snake Keylogger + - Ransomware - MoonPeak - BlackSuit Ransomware + - Emotet Malware DHS Report TA18-201A + - Sneaky Active Directory Persistence Tricks + - Amadey + - Remcos - Braodo Stealer + - Windows Registry Abuse + - Nexus APT Threat Activity + - Suspicious MSHTA Activity + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 @@ -115,7 +118,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index fa6a03e4f6..ccdeb39f99 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -1,6 +1,6 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 624108b462..1726b73a91 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -1,6 +1,6 @@ name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 9f94569a83..45d08b0f06 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: 10 -date: '2024-11-13' +version: 11 +date: '2025-01-27' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: TTP @@ -65,10 +65,12 @@ rba: threat_objects: [] tags: analytic_story: - - Ransomware - CISA AA23-347A - - Active Directory Lateral Movement + - Ransomware - Suspicious WMI Use + - Active Directory Lateral Movement + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1047 @@ -80,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml deleted file mode 100644 index f94851f9d4..0000000000 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Remote System Discovery with Net -id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 -version: 5 -date: '2024-12-10' -author: Mauricio Velazco, Splunk -status: production -type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` - with command-line arguments used to discover remote systems, such as `domain computers - /domain`. This detection leverages data from Endpoint Detection and Response (EDR) - agents, focusing on process names and command-line arguments. This activity is significant - as it indicates potential reconnaissance efforts by adversaries or Red Teams to - map out networked systems and Active Directory structures. If confirmed malicious, - this behavior could lead to further network exploitation, privilege escalation, - or lateral movement within the environment. -data_source: -- Sysmon EventID 1 -- Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*domain - computers*" AND Processes.process=*/do*) OR (Processes.process="*view*" AND Processes.process=*/do*) - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this command for troubleshooting. -references: -- https://attack.mitre.org/techniques/T1018/ -- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ -tags: - analytic_story: - - Active Directory Discovery - - IcedID - asset_type: Endpoint - mitre_attack_id: - - T1018 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: endpoint -tests: -- name: True Positive Test - attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index aa845361b4..151768e0f0 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -1,6 +1,6 @@ name: Rundll32 Control RunDLL World Writable Directory id: 1adffe86-10c3-11ec-8ce6-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index e4835bb1c1..2ca5eeaf14 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -1,6 +1,6 @@ name: Sc exe Manipulating Windows Services id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d -version: 7 +version: 8 date: '2024-11-13' author: Rico Valdez, Splunk status: production @@ -64,14 +64,15 @@ rba: threat_objects: [] tags: analytic_story: - - Windows Service Abuse - - DHS Report TA18-074A + - Azorult - Orangeworm Attack Group + - Windows Drivers + - NOBELIUM Group - Windows Persistence Techniques - Disabling Security Tools - - NOBELIUM Group - - Azorult - - Windows Drivers + - Windows Service Abuse + - DHS Report TA18-074A + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1543.003 diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index c7dc14ae19..6d89907f5b 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,7 +1,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c -version: 9 -date: '2024-11-13' +version: 11 +date: '2025-01-27' author: Bhavin Patel, Splunk status: production type: TTP @@ -66,30 +66,32 @@ rba: threat_objects: [] tags: analytic_story: - - AsyncRAT - - Winter Vivern - Windows Persistence Techniques - - Living Off The Land - - Prestige Ransomware - - AgentTesla - - NjRAT - - RedLine Stealer - - Rhysida Ransomware - - Azorult - DHS Report TA18-074A - - Scheduled Tasks - - Sandworm Tools - - Qakbot - - CISA AA22-257A - Trickbot + - CISA AA23-347A + - Qakbot + - Azorult + - ShrinkLocker + - AsyncRAT + - Phemedrone Stealer + - NjRAT + - Prestige Ransomware + - Scheduled Tasks + - AgentTesla + - MoonPeak - NOBELIUM Group + - Living Off The Land + - CISA AA22-257A + - CISA AA24-241A - Amadey - DarkCrystal RAT - - CISA AA23-347A - - Phemedrone Stealer - - ShrinkLocker - - MoonPeak - - CISA AA24-241A + - Sandworm Tools + - Winter Vivern + - Nexus APT Threat Activity + - Earth Estries + - Rhysida Ransomware + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -102,7 +104,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 72e8073ffc..b49abbe0fc 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -1,6 +1,6 @@ name: Schtasks used for forcing a reboot id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6 -version: 7 +version: 8 date: '2024-11-13' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 735ed9149a..1abd21eb3c 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -1,6 +1,6 @@ name: ServicePrincipalNames Discovery with SetSPN id: ae8b3efc-2d2e-11ec-8b57-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 64fdb6d6c2..9e30f471ff 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -1,7 +1,7 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 version: 8 -date: '2024-12-10' +date: '2024-12-16' author: David Dorsey, Splunk status: production type: TTP @@ -17,21 +17,8 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", - "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?") by Processes.process_name Processes.parent_process_name - Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection - and Response (EDR) agents. These agents are designed to provide security-related - telemetry from the endpoints where the agent is installed. To implement this search, - you must ingest logs that contain the process GUID, process name, and parent process. - Additionally, you must ingest complete command-line executions. These logs must - be processed using the appropriate Splunk Technology Add-ons that are specific to - the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` - data model. Use the Splunk Common Information Model (CIM) to normalize the field - names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: None identified references: [] drilldown_searches: @@ -75,7 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index ee46ef235d..a41111a7b1 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -1,6 +1,6 @@ name: Spoolsv Suspicious Process Access id: 799b606e-da81-11eb-93f8-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml index 25a57db4be..04edcd2a70 100644 --- a/detections/endpoint/suspicious_computer_account_name_change.yml +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -1,6 +1,6 @@ name: Suspicious Computer Account Name Change id: 35a61ed8-61c4-11ec-bc1e-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 6686bd987c..1d636ec76c 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -17,18 +17,14 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) - as process_name values(Processes.process) as process min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" - OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" - OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path = "*\\Users\\Administrator\\Music\\*" - OR Processes.process_path = "*\\Windows\\servicing\\*" OR Processes.process_path - = "*\\Users\\Default\\*" OR Processes.process_path = "*Recycle.bin*" OR Processes.process_path - = "*\\Windows\\Media\\*" OR Processes.process_path = "\\Windows\\repair\\*" OR Processes.process_path - = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" by Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.dest Processes.user | - `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `suspicious_process_file_path_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", + "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", + "*\\temp\\*" , "*\\PerfLogs\\*","*\\windows\\tasks\\*", "*:\\programdata\\*") by + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_path Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,40 +68,41 @@ rba: type: process_name tags: analytic_story: - - Double Zero Destructor - - Graceful Wipe Out Attack - - AsyncRAT - - WhisperGate - - Prestige Ransomware - - DarkGate Malware - - AgentTesla - - Brute Ratel C4 - - RedLine Stealer - - Rhysida Ransomware - - Swift Slicer - - IcedID - - DarkCrystal RAT - - Chaos Ransomware - - PlugX - - Industroyer2 - - Azorult - - Remcos - - XMRig - - Qakbot - Volt Typhoon + - LockBit Ransomware + - Data Destruction + - XMRig + - DarkGate Malware + - Chaos Ransomware + - Double Zero Destructor - Hermetic Wiper - Warzone RAT - - Trickbot - - Amadey - - BlackByte Ransomware - - LockBit Ransomware - - CISA AA23-347A - - Data Destruction - Phemedrone Stealer + - Prestige Ransomware + - Graceful Wipe Out Attack + - BlackByte Ransomware + - IcedID - Handala Wiper - - MoonPeak - - ValleyRAT - Meduza Stealer + - CISA AA23-347A + - AsyncRAT + - Amadey + - Industroyer2 + - ValleyRAT + - Rhysida Ransomware + - DarkCrystal RAT + - Crypto Stealer + - Azorult + - Swift Slicer + - AgentTesla + - Qakbot + - Remcos + - Trickbot + - Brute Ratel C4 + - RedLine Stealer + - PlugX + - MoonPeak + - WhisperGate asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 1d7dfc280a..0add6178bb 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -1,6 +1,6 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -version: 8 +version: 9 date: '2024-11-13' author: David Dorsey, Splunk status: production diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 25cbe43482..1167ae4fa3 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,7 +1,7 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: 7 -date: '2024-11-13' +version: 11 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -73,10 +73,13 @@ rba: type: process_name tags: analytic_story: + - Qakbot + - Earth Estries - Suspicious Regsvr32 Activity - IcedID + - Derusbi + - Nexus APT Threat Activity - Living Off The Land - - Qakbot asset_type: Endpoint mitre_attack_id: - T1218 @@ -89,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 31ca3d198e..6443c7a1f4 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Suspicious Rundll32 dllregisterserver id: 8c00a385-9b86-4ac0-8932-c9ec3713b159 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 4d9e3a04f5..7fce587c31 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -1,7 +1,7 @@ name: Suspicious Scheduled Task from Public Directory id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: Anomaly @@ -65,15 +65,18 @@ rba: threat_objects: [] tags: analytic_story: - - Azorult - - Ryuk Ransomware - - Scheduled Tasks - - Ransomware - Windows Persistence Techniques - - Living Off The Land - - DarkCrystal RAT - CISA AA23-347A + - Ransomware + - DarkCrystal RAT + - Scheduled Tasks + - Azorult + - Crypto Stealer + - Nexus APT Threat Activity + - Living Off The Land - MoonPeak + - Ryuk Ransomware + - Earth Estries - CISA AA24-241A asset_type: Endpoint mitre_attack_id: @@ -87,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 321027b633..db66f571be 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,6 +1,6 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 8 +version: 9 date: '2024-11-13' author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index 7735319ec4..104fb978fa 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -1,6 +1,6 @@ name: Unusual Number of Kerberos Service Tickets Requested id: eb3e6702-8936-11ec-98fe-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Mauricio Velazco, Dean Luxton, Splunk status: production diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 01b12d08d9..9f00ab5ca2 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,7 +1,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: 6 -date: '2024-12-10' +version: 10 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,12 +57,16 @@ rba: tags: analytic_story: - Brute Ratel C4 - - AsyncRAT - - DarkGate Malware - - CISA AA23-347A - PlugX + - AsyncRAT + - CISA AA23-347A + - WinDealer RAT - ValleyRAT + - Derusbi + - Nexus APT Threat Activity + - DarkGate Malware - Meduza Stealer + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1134.002 @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml new file mode 100644 index 0000000000..709d34b600 --- /dev/null +++ b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml @@ -0,0 +1,59 @@ +name: Windows Account Access Removal via Logoff Exec +id: 223572ab-8768-4e20-9b39-c38707af80dc +version: 1 +date: '2024-12-17' +author: Teoderick Contreras, Splunk +data_source: +- Sysmon EventID 1 +type: Anomaly +status: production +description: The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = logoff.exe + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_account_access_removal_via_logoff_exec_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command. +references: +- https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Process having child process [$process_name$] used to logoff user on [$dest$]. + risk_objects: + - field: dest + type: system + score: 36 + - field: user + type: user + score: 36 + threat_objects: [] +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1531 + - T1059.001 + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 9b011c912c..87740e631d 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,6 +1,6 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Dean Luxton, Splunk type: TTP diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 1a951ffa45..d84075b5e2 100644 --- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Cross Domain SID History Addition id: 41bbb371-28ba-439c-bb5c-d9930c28365d -version: 5 +version: 6 date: '2024-12-10' author: Dean Luxton type: TTP diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 5afac44a1b..a303064df9 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 7 +version: 8 date: '2024-12-10' author: Dean Luxton type: TTP diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml index 5d9c443b23..e6e6c0b674 100644 --- a/detections/endpoint/windows_ad_short_lived_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_server_object.yml @@ -48,12 +48,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Potential DCShadow Attack Detected on $Computer$ + message: A short-lived server object was created and deleted on $Computer$ risk_objects: - field: Computer type: system score: 64 - - field: SubjectUsername + - field: SubjectUserName type: user score: 64 threat_objects: [] diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml index 9ff5c8ee67..363e9075c2 100644 --- a/detections/endpoint/windows_alternate_datastream___executable_content.yml +++ b/detections/endpoint/windows_alternate_datastream___executable_content.yml @@ -1,6 +1,6 @@ name: Windows Alternate DataStream - Executable Content id: a258bf2a-34fd-4986-8086-78f506e00206 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_apache_benchmark_binary.yml b/detections/endpoint/windows_apache_benchmark_binary.yml index 17a494d0c6..ecbb29f74e 100644 --- a/detections/endpoint/windows_apache_benchmark_binary.yml +++ b/detections/endpoint/windows_apache_benchmark_binary.yml @@ -1,6 +1,6 @@ name: Windows Apache Benchmark Binary id: 894f48ea-8d85-4dcd-9132-c66cdb407c9b -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml index 4001d4d719..d3403433b5 100644 --- a/detections/endpoint/windows_archive_collected_data_via_rar.yml +++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml @@ -1,7 +1,7 @@ name: Windows Archive Collected Data via Rar id: 2015de95-fe91-413d-9d62-2fe011b67e82 -version: 4 -date: '2024-11-13' +version: 5 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -61,6 +61,8 @@ rba: threat_objects: [] tags: analytic_story: + - Earth Estries + - Nexus APT Threat Activity - DarkGate Malware asset_type: Endpoint mitre_attack_id: @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml new file mode 100644 index 0000000000..0719d4656f --- /dev/null +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -0,0 +1,65 @@ +name: Windows Attempt To Stop Security Service +id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 +version: 2 +date: '2025-01-13' +author: Rico Valdez, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" or "net.exe" command with the "stop" parameter or the PowerShell "Stop-Service" cmdlet. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `windows_attempt_to_stop_security_service_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: None identified. Attempts to disable security-related services should be identified and understood. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. + risk_objects: + - field: user + type: user + score: 20 + - field: dest + type: system + score: 20 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - WhisperGate + - Graceful Wipe Out Attack + - Disabling Security Tools + - Data Destruction + - Azorult + - Trickbot + asset_type: Endpoint + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_autoit3_execution.yml b/detections/endpoint/windows_autoit3_execution.yml index 3d8d0a00bb..e6ddf3ce77 100644 --- a/detections/endpoint/windows_autoit3_execution.yml +++ b/detections/endpoint/windows_autoit3_execution.yml @@ -1,6 +1,6 @@ name: Windows AutoIt3 Execution id: 0ecb40d9-492b-4a57-9f87-515dd742794c -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production @@ -67,8 +67,9 @@ rba: type: process_name tags: analytic_story: - - DarkGate Malware + - Crypto Stealer - Handala Wiper + - DarkGate Malware asset_type: Endpoint atomic_guid: [] mitre_attack_id: diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index a14fab9b60..30f986c479 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -1,6 +1,6 @@ name: Windows Binary Proxy Execution Mavinject DLL Injection id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml index 697b12d58d..9be44cb329 100644 --- a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml +++ b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml @@ -38,11 +38,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 961285c2ab..974d986e9f 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -54,10 +54,11 @@ rba: threat_objects: [] tags: analytic_story: - - Chaos Ransomware - NjRAT - RedLine Stealer - Gozi Malware + - Crypto Stealer + - Chaos Ransomware asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_certutil_download_with_url_argument.yml b/detections/endpoint/windows_certutil_download_with_url_argument.yml index e7ac8ebf6c..87ff45c03c 100644 --- a/detections/endpoint/windows_certutil_download_with_url_argument.yml +++ b/detections/endpoint/windows_certutil_download_with_url_argument.yml @@ -1,6 +1,6 @@ name: Windows CertUtil Download With URL Argument id: 4fc5ca00-4c7c-46b3-8772-c98a4b8bd944 -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml new file mode 100644 index 0000000000..441ba5036d --- /dev/null +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -0,0 +1,68 @@ +name: Windows Cmdline Tool Execution From Non-Shell Process +id: 2afa393f-b88d-41b7-9793-623c93a2dfde +version: 2 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "explorer.exe", "-", "unknown") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. +references: +- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation +- https://attack.mitre.org/groups/G0046/ +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A non-standard parent process $parent_process_name$ spawned child process + $process_name$ to execute command-line tool on $dest$. + risk_objects: + - field: dest + type: system + score: 56 + - field: user + type: user + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Volt Typhoon + - Rhysida Ransomware + - FIN7 + - DarkGate Malware + - Qakbot + - CISA AA22-277A + - CISA AA23-347A + - Gozi Malware + asset_type: Endpoint + mitre_attack_id: + - T1059 + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml index 80717d56c4..4c8b9324c6 100644 --- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml @@ -1,6 +1,6 @@ name: Windows COM Hijacking InprocServer32 Modification id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml index a550cb6016..8e8aba3b57 100644 --- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -1,44 +1,15 @@ name: Windows Common Abused Cmd Shell Risk Behavior id: e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a version: 4 -date: '2024-11-13' +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Correlation data_source: [] -description: The following analytic identifies instances where four or more distinct - detection analytics are associated with malicious command line behavior on a specific - host. This detection leverages the Command Line Interface (CLI) data from various - sources to identify suspicious activities. This behavior is significant as it often - indicates attempts to execute malicious commands, access sensitive data, install - backdoors, or perform other nefarious actions. If confirmed malicious, attackers - could gain unauthorized control, exfiltrate information, escalate privileges, or - launch further attacks within the network, leading to severe compromise. -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) - as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) - as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as - annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) - as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) - as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) - as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, - dc(source) as source_count from datamodel=Risk.All_Risk where source IN ("*Cmdline - Tool Not Executed In CMD Shell*", "*Windows System Network Config Discovery Display - DNS*", "*Local Account Discovery With Wmic*", "*Net Localgroup Discovery*", "*Create - local admin accounts using net exe*", "*Local Account Discovery with Net*", "*Icacls - Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes - launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections - Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery - Using ldap Nslookup*", "*Windows System Shutdown CommandLine*") by All_Risk.risk_object - All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where - source_count >= 4 | `windows_common_abused_cmd_shell_risk_behavior_filter`' -how_to_implement: Splunk Enterprise Security is required to utilize this correlation. - In addition, modify the source_count value to your environment. In our testing, - a count of 4 or 5 was decent in a lab, but the number may need to be increased base - on internal testing. In addition, based on false positives, modify any analytics - to be anomaly and lower or increase risk based on organization importance. -known_false_positives: False positives will be present based on many factors. Tune - the correlation as needed to reduce too many triggers. +description: The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. This detection leverages the Command Line Interface (CLI) data from various sources to identify suspicious activities. This behavior is significant as it often indicates attempts to execute malicious commands, access sensitive data, install backdoors, or perform other nefarious actions. If confirmed malicious, attackers could gain unauthorized control, exfiltrate information, escalate privileges, or launch further attacks within the network, leading to severe compromise. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where source IN ("*Windows Cmdline Tool Execution From Non-Shell Process*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Windows Group Discovery Via Net*", "*Windows Create Local Administrator Account Via Net*", "*Windows User Discovery Via Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*") by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 | `windows_common_abused_cmd_shell_risk_behavior_filter`' +how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased base on internal testing. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance. +known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers. references: - https://www.splunk.com/en_us/blog/security/from-macros-to-no-macros-continuous-malware-improvements-by-qakbot.html - https://www.splunk.com/en_us/blog/security/dark-crystal-rat-agent-deep-dive.html @@ -48,12 +19,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$risk_object$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$risk_object$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: @@ -85,7 +51,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/risk_behavior/abused_commandline/risk_recon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/risk_behavior/abused_commandline/risk_recon.log source: risk sourcetype: stash diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml new file mode 100644 index 0000000000..9a9f76fffd --- /dev/null +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -0,0 +1,63 @@ +name: Windows Create Local Administrator Account Via Net +id: 2c568c34-bb57-4b43-9d75-19c605b98e70 +version: 2 +date: '2025-01-13' +author: Bhavin Patel, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process=*/add* AND Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*") by Processes.process Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_create_local_administrator_account_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators often leverage net.exe to create admin accounts. +references: [] +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators + group. + risk_objects: + - field: user + type: user + score: 30 + - field: dest + type: system + score: 30 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - DHS Report TA18-074A + - Azorult + - CISA AA22-257A + - DarkGate Malware + - CISA AA24-241A + asset_type: Endpoint + mitre_attack_id: + - T1136.001 + - T1136 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index 1308709d7f..b33e006ced 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -1,6 +1,6 @@ name: Windows Credential Dumping LSASS Memory Createdump id: b3b7ce35-fce5-4c73-85f4-700aeada81a9 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 4187f7e939..c981720bb5 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,17 +51,19 @@ rba: threat_objects: [] tags: analytic_story: - - RedLine Stealer + - Snake Keylogger - Amadey - Warzone RAT - - NjRAT - - DarkGate Malware - - Phemedrone Stealer - - Snake Keylogger - - MoonPeak - - Braodo Stealer - PXA Stealer + - Braodo Stealer + - Phemedrone Stealer + - Nexus APT Threat Activity + - DarkGate Malware - Meduza Stealer + - MoonPeak + - Earth Estries + - NjRAT + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1012 @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_local_state_simulate_access/redline-localstate-smalldata-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_local_state_simulate_access/redline-localstate-smalldata-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index e09e6ae597..5ed95dadf5 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 6 -date: '2024-12-10' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,17 +52,19 @@ rba: threat_objects: [] tags: analytic_story: - - RedLine Stealer + - Snake Keylogger - Amadey - Warzone RAT - - NjRAT - - DarkGate Malware - - Phemedrone Stealer - - Snake Keylogger - - MoonPeak - - Braodo Stealer - PXA Stealer + - Braodo Stealer + - Phemedrone Stealer + - Nexus APT Threat Activity + - DarkGate Malware - Meduza Stealer + - MoonPeak + - Earth Estries + - NjRAT + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1012 @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_login_data_simulate_access/redline-login-data-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_login_data_simulate_access/redline-login-data-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 34dfea6cf0..fc5ad0009f 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,7 +1,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: 6 -date: '2024-12-10' +version: 8 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -70,10 +70,12 @@ rba: type: process_name tags: analytic_story: - - IcedID - - Compromised Windows Host - Ingress Tool Transfer - Forest Blizzard + - IcedID + - Nexus APT Threat Activity + - Compromised Windows Host + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1105 @@ -85,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 0ebd3235eb..8b99b345c5 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -1,6 +1,6 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml index 4955cf8b89..0f8ba948b0 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -1,6 +1,6 @@ name: Windows Default Group Policy Object Modified id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml index 6c21379d47..732f0e172d 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml @@ -1,6 +1,6 @@ name: Windows Default Group Policy Object Modified with GPME id: eaf688b3-bb8f-454d-b105-920a862cd8cb -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_detect_network_scanner_behavior.yml b/detections/endpoint/windows_detect_network_scanner_behavior.yml index 7a05993d0d..3db7828a2b 100644 --- a/detections/endpoint/windows_detect_network_scanner_behavior.yml +++ b/detections/endpoint/windows_detect_network_scanner_behavior.yml @@ -1,63 +1,63 @@ -name: Windows Detect Network Scanner Behavior -id: 78e678d2-bf64-4fe6-aa52-2f7b11dddee7 -version: 2 -date: '2025-01-09' -author: Steven Dick -status: production -type: Anomaly -description: The following analytic detects when an application is used to connect a large number of unique ports/targets within a short time frame. Network enumeration may be used by adversaries as a method of discovery, lateral movement, or remote execution. This analytic may require significant tuning depending on the organization and applications being actively used, highly recommended to pre-populate the filter macro prior to activation. -data_source: -- Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count latest(All_Traffic.dest_port) as dest_port dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port IN (8443,8080,5353,3268,443,389,88,80,53,25) by host,All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user _time span=5m -| `drop_dm_object_name(All_Traffic)` -| rex field=app ".*\\\(?.*)$" -| where port_count > 10 OR dest_count > 10 -| stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) as count by host,user,app,process_name -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `windows_detect_network_scanner_behavior_filter`' -how_to_implement: This detection relies on Sysmon EventID 3 events being ingested AND tagged into the Network_Traffic datamodel. -known_false_positives: Various, could be noisy depending on processes in the organization and sysmon configuration used. Adjusted port/dest count thresholds as needed. -references: -- https://attack.mitre.org/techniques/T1595 -drilldown_searches: -- name: View the detection results for - "$src$" and "$user$" - search: '%original_detection_search% | search src = "$src$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: A process exhibiting network scanning behavior [$process_name$] was detected on $src$ - risk_objects: - - field: src - type: system - score: 25 - - field: user - type: user - score: 25 - threat_objects: - - field: process_name - type: process_name -tags: - analytic_story: - - Network Discovery - - Windows Discovery Techniques - asset_type: Endpoint - mitre_attack_id: - - T1595 - - T1595.001 - - T1595.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/sysmon_scanning_events/sysmon_scanning_events.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog +name: Windows Detect Network Scanner Behavior +id: 78e678d2-bf64-4fe6-aa52-2f7b11dddee7 +version: 3 +date: '2025-01-09' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic detects when an application is used to connect a large number of unique ports/targets within a short time frame. Network enumeration may be used by adversaries as a method of discovery, lateral movement, or remote execution. This analytic may require significant tuning depending on the organization and applications being actively used, highly recommended to pre-populate the filter macro prior to activation. +data_source: +- Sysmon EventID 3 +search: '| tstats `security_content_summariesonly` count latest(All_Traffic.dest_port) as dest_port dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port IN (8443,8080,5353,3268,443,389,88,80,53,25) by host,All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user _time span=5m +| `drop_dm_object_name(All_Traffic)` +| rex field=app ".*\\\(?.*)$" +| where port_count > 10 OR dest_count > 10 +| stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) as count by host,user,app,process_name +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_detect_network_scanner_behavior_filter`' +how_to_implement: This detection relies on Sysmon EventID 3 events being ingested AND tagged into the Network_Traffic datamodel. +known_false_positives: Various, could be noisy depending on processes in the organization and sysmon configuration used. Adjusted port/dest count thresholds as needed. +references: +- https://attack.mitre.org/techniques/T1595 +drilldown_searches: +- name: View the detection results for - "$src$" and "$user$" + search: '%original_detection_search% | search src = "$src$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$src$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A process exhibiting network scanning behavior [$process_name$] was detected on $src$ + risk_objects: + - field: src + type: system + score: 25 + - field: user + type: user + score: 25 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Network Discovery + - Windows Discovery Techniques + asset_type: Endpoint + mitre_attack_id: + - T1595 + - T1595.001 + - T1595.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/sysmon_scanning_events/sysmon_scanning_events.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index c8c1b362d2..c53c115e73 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -1,6 +1,6 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index c84583ff24..b21faffa59 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -62,8 +62,9 @@ rba: type: parent_process_name tags: analytic_story: - - NjRAT - PXA Stealer + - NjRAT + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1562 diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 8419dcfa0e..5c03275ca5 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -1,6 +1,6 @@ name: Windows Disable Windows Event Logging Disable HTTP Logging id: 23fb6787-255f-4d5b-9a66-9fd7504032b5 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index 8a4786b5ea..a84e7ed383 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -1,6 +1,6 @@ name: Windows DISM Remove Defender id: 8567da9e-47f0-11ec-99a9-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml index 5ddb5d8355..d5d279ce64 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -1,6 +1,6 @@ name: Windows DLL Search Order Hijacking with iscsicpl id: f39ee679-3b1e-4f47-841c-5c3c580acda2 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml b/detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml new file mode 100644 index 0000000000..39e7c9496e --- /dev/null +++ b/detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml @@ -0,0 +1,56 @@ +name: Windows DNS Query Request by Telegram Bot API +id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_source: +- Sysmon EventID 22 +type: Anomaly +status: production +description: The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network. +search: '`sysmon` EventCode=22 query = "api.telegram.org" process_name != "telegram.exe" + | stats count min(_time) as firstTime max(_time) as lastTime by query answer QueryResults QueryStatus process_name process_guid Computer + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dns_query_request_by_telegram_bot_api_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: a third part automation using telegram API. +references: +- https://www.splunk.com/en_us/blog/security/threat-advisory-telegram-crypto-botnet-strt-ta01.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: DNS query by a telegram bot [$query$] on [$dest$]. + risk_objects: + - field: dest + type: system + score: 36 + threat_objects: [] +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1102.002 + - T1071.004 + - T1071 + - T1102 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index c66728ad30..806aa64509 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,7 +1,7 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f version: 6 -date: '2024-12-10' +date: '2025-01-20' author: Mauricio Velazco, Splunk status: production type: TTP @@ -33,7 +33,7 @@ search: '`wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName I | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Authentication events across all endpoints and ingest Event Id 4627. Specifically, - the Audit Group Membership subcategory within the Logon Logooff category needs to + the Audit Group Membership subcategory within the Logon Logoff category needs to be enabled. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. @@ -83,7 +83,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558/diamond_ticket/security.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index a356cdce76..6efd4b398f 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index b5ebbbb517..7e3badca4e 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -23,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers. -known_false_positives: This analytic is meant to assist with identifying drivers loaded - in the environment and not to be setup for notables off the bat. +known_false_positives: This analytic is meant to assist with identifying and hunting drivers loaded + in the environment. references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - https://attack.mitre.org/techniques/T1014/ diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 64eb743762..373e172977 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -1,32 +1,18 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 -version: 4 -date: '2024-12-10' +version: 5 +date: '2025-01-13' author: Michael Haag, Splunk +status: production +type: TTP data_source: - Sysmon EventID 1 -type: TTP -status: production -description: This analytic detects attempts to create an "ESX Admins" group using - the Windows net.exe or net1.exe commands. This activity may indicate an attempt - to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability - (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi - hosts by recreating the "ESX Admins" group after its deletion from Active Directory. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*group - \"ESX Admins\"*" OR Processes.process="*group ESX Admins*") AND Processes.process="*/add*" - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.original_file_name - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_esx_admins_group_creation_via_net_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - data that records process activity from your hosts to populate the Endpoint data - model in the Processes node. If you are using Sysmon, you must have at least version - 6.0.4 of the Sysmon TA. -known_false_positives: Legitimate administrators might create an "ESX Admins" group - for valid reasons. Verify that the group creation is authorized and part of normal - administrative tasks. Consider the context of the action, such as the user performing - it and any related activities. +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +description: This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process="*ESX Admins*" AND Processes.process="*/add*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_net_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Legitimate administrators might create an "ESX Admins" group for valid reasons. Verify that the group creation is authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities. references: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ @@ -37,12 +23,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", - "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) - as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk - Message" values(analyticstories) as "Analytic Stories" values(annotations._all) - as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" - by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -73,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml index 71b3808e94..fd301786bb 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml @@ -1,6 +1,6 @@ name: Windows ESX Admins Group Creation via PowerShell id: f48a5557-be06-4b96-b8e8-be563e387620 -version: 3 +version: 4 date: '2024-11-13' author: Michael Haag, Splunk data_source: diff --git a/detections/endpoint/windows_excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml new file mode 100644 index 0000000000..9267afdd3c --- /dev/null +++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml @@ -0,0 +1,55 @@ +name: Windows Excessive Service Stop Attempt +id: 8f3a614f-6b98-4f7d-82dd-d0df38452a8b +version: 1 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects multiple attempts to stop or delete services on a system using `net.exe` or `sc.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR `process_sc`) AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - XMRig + - Ransomware + - BlackByte Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml new file mode 100644 index 0000000000..10716cc575 --- /dev/null +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -0,0 +1,62 @@ +name: Windows Excessive Usage Of Net App +id: 355ba810-0a20-4215-8485-9ce3f87f2e38 +version: 2 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects excessive usage of `net.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining incidents. If confirmed malicious, this activity could lead to unauthorized user account manipulation, potentially compromising system integrity and enabling further malicious actions. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_usage_of_net_app_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: unknown. Filter as needed. Modify the time span as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ + has been detected on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 28 + - field: dest + type: system + score: 28 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Prestige Ransomware + - Graceful Wipe Out Attack + - XMRig + - Windows Post-Exploitation + - Azorult + - Ransomware + - Rhysida Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 576e79a52b..abbcec0359 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -1,6 +1,6 @@ name: Windows Execute Arbitrary Commands with MSDT id: e1d5145f-38fe-42b9-a5d5-457796715f97 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml new file mode 100644 index 0000000000..31f3eb0a66 --- /dev/null +++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml @@ -0,0 +1,61 @@ +name: Windows File and Directory Enable ReadOnly Permissions +id: 1ae407b0-a042-4eb0-834a-590da055575e +version: 1 +date: '2024-12-13' +author: Teoderick Contreras, Splunk +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: TTP +status: production +description: The following analytic detects instances where file or folder permissions are modified to grant read-only access. Such changes are characterized by the presence of read-related permissions (e.g., R, REA, RA, RD) and the absence of write (W) or execute (E) permissions. Monitoring these events is crucial for tracking access control changes that could be intentional for restricting access or indicative of malicious behavior. Alerts generated by this detection help ensure that legitimate security measures are enforced while unauthorized changes are promptly investigated. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") AND Processes.process IN ("*SYSTEM*", "*admin*", "*S-1-1-0*", "*EVERYONE*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | rex field=process ":\\((?[^)]+)\\)" + | eval has_read_attribute=if(match(permission, "R"), "true", "false") + | eval has_write_execute=if(match(permission, "(W|GA|X|M|F|AD|DC|DE)"), "true", "false") + | where has_write_execute="false" and has_read_attribute = "true" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_and_directory_enable_readonly_permissions_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A [$process_name$] was executed on [$dest$] attempting to change the access to a file or directory into readonly permissions. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1222.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml new file mode 100644 index 0000000000..71b96e2add --- /dev/null +++ b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml @@ -0,0 +1,48 @@ +name: Windows File and Directory Permissions Enable Inheritance +id: 0247f90a-aca4-47b2-a94d-e30f445d7b41 +version: 1 +date: '2024-12-13' +author: Teoderick Contreras, Splunk +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: Hunting +status: production +description: The following analytic detects the enabling of permission inheritance using ICACLS. This analytic identifies instances where ICACLS commands are used to enable permission inheritance on files or directories. The /inheritance:e flag, which restores inherited permissions from a parent directory, is monitored to detect changes that might reapply broader access control settings. Enabling inheritance can indicate legitimate administrative actions but may also signal attempts to override restrictive custom permissions, potentially exposing sensitive files to unauthorized access. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:e*" + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_and_directory_permissions_enable_inheritance_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1222.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml new file mode 100644 index 0000000000..8c8d1cbacf --- /dev/null +++ b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml @@ -0,0 +1,57 @@ +name: Windows File and Directory Permissions Remove Inheritance +id: 9b62da2c-e442-474f-83ca-fac4dabab1b3 +version: 1 +date: '2024-12-13' +author: Teoderick Contreras, Splunk +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: Anomaly +status: production +description: The following analytic detects the removal of permission inheritance using ICACLS. This analytic identifies instances where ICACLS is used to remove permission inheritance from files or directories. The /inheritance:r flag, which strips inherited permissions while optionally preserving or altering explicit permissions, is monitored to detect changes that may restrict access or establish isolated permission configurations. Removing inheritance can be a legitimate administrative action but may also indicate an attempt to conceal malicious activity or bypass inherited security controls. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:r*" + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_and_directory_permissions_remove_inheritance_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A [$process_name$] was executed on [$dest$] attempting to remove inheritance permissions. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1222.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index bd56073432..344bcb30ed 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -17,7 +17,7 @@ description: The following analytic detects the execution of the Invoke-ShareFin and sensitive data. search: '`powershell` EventCode=4104 (ScriptBlockText=Invoke-ShareFinder*) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | rename UserID as user | `security_content_ctime(firstTime)` | + ScriptBlockText | rename UserID as user | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_share_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -29,12 +29,12 @@ references: - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ - https://attack.mitre.org/techniques/T1135/ drilldown_searches: -- name: View the detection results for - "$Computer$" and "$user$" - search: '%original_detection_search% | search Computer = "$Computer$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -43,12 +43,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Invoke-ShareFinder commandlet was executed on $Computer$ + message: Invoke-ShareFinder commandlet was executed on $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 48 - - field: User + - field: user type: user score: 48 threat_objects: [] diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml index b141be9c81..90504904d8 100644 --- a/detections/endpoint/windows_findstr_gpp_discovery.yml +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -1,6 +1,6 @@ name: Windows Findstr GPP Discovery id: 1631ac2d-f2a9-42fa-8a59-d6e210d472f5 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk type: TTP diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml new file mode 100644 index 0000000000..b351dac9de --- /dev/null +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -0,0 +1,54 @@ +name: Windows Group Discovery Via Net +id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +version: 1 +date: '2025-01-13' +author: Michael Haag, Mauricio Velazco, Splunk +status: production +type: Hunting +description: The following analytic identifies the execution of `net.exe` with command-line arguments used to query global, local and domain groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local or domain groups, which is a common step in Active Directory or privileged accounts discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_group_discovery_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://attack.mitre.org/techniques/T1069/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +tags: + analytic_story: + - Windows Post-Exploitation + - Active Directory Discovery + - Prestige Ransomware + - Graceful Wipe Out Attack + - Rhysida Ransomware + - Cleo File Transfer Software + - Volt Typhoon + - IcedID + - Windows Discovery Techniques + - Azorult + asset_type: Endpoint + mitre_attack_id: + - T1069 + - T1069.001 + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml new file mode 100644 index 0000000000..d312721aa7 --- /dev/null +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -0,0 +1,57 @@ +name: Windows HTTP Network Communication From MSIExec +id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 +version: 2 +date: '2025-01-17' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment. +data_source: +- Sysmon EventID 1 AND Sysmon EventID 3 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] | table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip | `windows_http_network_communication_from_msiexec_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: False positives will be present and filtering is required. +references: +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ contacting + a remote destination $dest_ip$ + risk_objects: + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + mitre_attack_id: + - T1218.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index bd66a0d8fb..eb129002c3 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -1,6 +1,6 @@ name: Windows IIS Components Add New Module id: 38fe731c-1f13-43d4-b878-a5bbe44807e3 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml index 9d3ed5adac..0499d7e3de 100644 --- a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml +++ b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml @@ -1,6 +1,6 @@ name: Windows Impair Defenses Disable AV AutoStart via Registry id: 31a13f43-812e-4752-a6ca-c6c87bf03e83 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index 8bfb3df253..75fd3bf93a 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -1,6 +1,6 @@ name: Windows Ingress Tool Transfer Using Explorer id: 76753bab-f116-4ea3-8fb9-89b638be58a9 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 3f0452bd4f..34a84e25f7 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil in Non Standard Path id: dcf74b22-7933-11ec-857c-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index 7058757a08..63710acabf 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 97ee5f6a58..7a969b6004 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Uninstall Option id: cfa7b9ac-43f0-11ec-9b48-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index fb760e80bd..20601ae9a5 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Uninstall Option with Network id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index bfae587299..980615a788 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil URL in Command Line id: 28e06670-43df-11ec-a569-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 8ed67cb7ab..19a3260fbf 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,6 +1,6 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 7 +version: 8 date: '2024-12-16' author: Michael Haag, Splunk status: experimental diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index f03a5ff5a1..30ab7ce4b3 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -1,6 +1,6 @@ name: Windows Ldifde Directory Object Behavior id: 35cd29ca-f08c-4489-8815-f715c45460d3 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml new file mode 100644 index 0000000000..713dc4223e --- /dev/null +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -0,0 +1,51 @@ +name: Windows List ENV Variables Via SET Command From Uncommon Parent +id: aec157f4-8783-4584-aca6-754c4dc7fba9 +version: 1 +date: '2025-01-17' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies a suspicious process command line fetching environment variables using the cmd.exe "set" command, with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity could be significant as it is commonly associated with malware like Qakbot, which uses this technique to gather system information. If confirmed malicious, this behavior could indicate that the parent process has been compromised, potentially allowing attackers to execute arbitrary commands, escalate privileges, or persist within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmd.exe" Processes.process IN ("*/c set", "*/c \"set") AND NOT Processes.parent_process_name IN ("cmd.exe", "explorer.exe", "powershell*" "pwsh.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_list_env_variables_via_set_command_from_uncommon_parent_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: shell process that are not included in this search may cause False positive. Filter as needed. +references: +- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: non-shell parent process has a child process $process_name$ with a commandline + $process$ to fetch env variables on $dest$ + risk_objects: + - field: dest + type: system + score: 56 + threat_objects: [] +tags: + analytic_story: + - Qakbot + asset_type: Endpoint + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index b33a7416d4..8578d406d4 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -1,6 +1,6 @@ name: Windows Mimikatz Binary Execution id: a9e0d6d3-9676-4e26-994d-4e0406bb4467 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml index 6d180da12f..f83503b284 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry ValleyRAT C2 Config id: ac59298a-8d81-4c02-8c9b-ffdac993891f -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml index cc16e59756..1f0d757c88 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry ValleyRat PWN Reg Entry id: 6947c44e-be1f-4dd9-b198-bc42be5be196 -version: 5 +version: 6 date: '2024-12-16' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 273ecf6bf3..5906eedfab 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -1,6 +1,6 @@ name: Windows MOF Event Triggered Execution via WMI id: e59b5a73-32bf-4467-a585-452c36ae10c1 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index fab94a6582..862e6c9f89 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 1d89715d94..ea822dfe4d 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index dde48d4cb7..a604c6a7d5 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Spawn Discovery Command id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_spawn_windbg.yml b/detections/endpoint/windows_msiexec_spawn_windbg.yml index 4e4121a5d0..c80059d8d6 100644 --- a/detections/endpoint/windows_msiexec_spawn_windbg.yml +++ b/detections/endpoint/windows_msiexec_spawn_windbg.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Spawn WinDBG id: 9a18f7c2-1fe3-47b8-9467-8b3976770a30 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index b7255c3665..697c254586 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Unregister DLLRegisterServer id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml new file mode 100644 index 0000000000..e746c54512 --- /dev/null +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -0,0 +1,37 @@ +name: Windows Network Connection Discovery Via Net +id: 86a5b949-679b-4197-8d4c-9c180a818c45 +version: 1 +date: '2025-01-13' +author: Mauricio Velazco, Splunk +status: production +type: Hunting +description: The following analytic identifies the execution of `net.exe` with command-line arguments used to list or display information about computer connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ +tags: + analytic_story: + - Active Directory Discovery + - Azorult + - Windows Post-Exploitation + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1049 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml new file mode 100644 index 0000000000..b6fcefc3dc --- /dev/null +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -0,0 +1,59 @@ +name: Windows Network Share Interaction Via Net +id: e51fbdb0-0be0-474f-92ea-d289f71a695e +version: 1 +date: '2025-01-20' +author: Dean Luxton +status: production +type: Anomaly +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +description: The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND Processes.process IN ("*use *", "*view*") BY Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_via_net_filter`' +how_to_implement: The detection is based on data originating from either Endpoint Detection and Response (EDR) telemetry or EventCode 4688 with process command line logging enabled. These sources provide security-related telemetry from the endpoints. To implement this search, you must ingest logs that contain the process name, parent process, and complete command-line executions. These logs must be mapped to the Splunk Common Information Model (CIM) to normalize the field names capture the data within the datamodel schema. +known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. +references: +- https://attack.mitre.org/techniques/T1135/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ leveraged net.exe on $dest$ to interact with network shares, + executed by parent process $parent_process$ + risk_objects: + - field: dest + type: system + score: 20 + - field: user + type: user + score: 20 + threat_objects: [] +tags: + analytic_story: + - Active Directory Discovery + - Active Directory Privilege Escalation + - Network Discovery + asset_type: Endpoint + atomic_guid: + - ab39a04f-0c93-4540-9ff2-83f862c385ae + mitre_attack_id: + - T1135 + - T1039 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_default_file_association_value_set.yml b/detections/endpoint/windows_new_default_file_association_value_set.yml new file mode 100644 index 0000000000..ad44980ccf --- /dev/null +++ b/detections/endpoint/windows_new_default_file_association_value_set.yml @@ -0,0 +1,47 @@ +name: Windows New Default File Association Value Set +id: 7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a +version: 1 +date: '2025-01-15' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects registry changes to the default file association value. It leverages data from the Endpoint data model, specifically monitoring registry paths under "HKCR\\*\\shell\\open\\command\\*". This activity can be significant because, attackers might alter the default file associations in order to execute arbitrary scripts or payloads when a user opens a file, leading to potential code execution. If confirmed malicious, this technique can enable attackers to persist on the compromised host and execute further malicious commands, posing a severe threat to the environment. +data_source: +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path IN ("*HKCR\\*", "*HKEY_CLASSES_ROOT\\*") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_new_default_file_association_value_set_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. +known_false_positives: Windows and third party software will create and modify these file associations during installation or upgrades. Additional filters needs to be applied to tune environment specific false positives. +references: +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Hermetic Wiper + - Windows Registry Abuse + - Prestige Ransomware + - Windows Privilege Escalation + - Windows Persistence Techniques + - Data Destruction + asset_type: Endpoint + mitre_attack_id: + - T1546.001 + - T1546 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml index 8c3b359024..30f031abec 100644 --- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid - Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name + Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name Registry.registry_path | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_eventlog_channelaccess_registry_value_set_filter`' how_to_implement: To successfully implement this search, you must be ingesting data diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 9d6caf3abd..aae826157a 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -1,6 +1,6 @@ name: Windows Ngrok Reverse Proxy Usage id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 62b05e5300..4a5461615e 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -1,6 +1,6 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml new file mode 100644 index 0000000000..63b11d9fe4 --- /dev/null +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -0,0 +1,56 @@ +name: Windows Obfuscated Files or Information via RAR SFX +id: 4ab6862b-ce88-4223-96c0-f6da2cffb898 +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_source: +- Sysmon Event ID 11 +type: Anomaly +status: production +description: The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery. +search: '`sysmon` EventCode=11 TargetFilename IN ("*__tmp_rar_sfx_access_check*") + | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename Computer + | rename Computer as dest + | rename TargetFilename as file_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_obfuscated_files_or_information_via_rar_sfx_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where rar sfx executable may be used. +known_false_positives: It can detect a third part utility software tool compiled to rar sfx. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A process commandline- [$Image$] that drops [$file_name$] on [$dest$]. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: + - field: file_name + type: file_name +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1027.013 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index 815aa3b02f..f7a52f0e6a 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -1,6 +1,6 @@ name: Windows Odbcconf Load DLL id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 0fa23e5e03..7d234fd114 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -1,6 +1,6 @@ name: Windows Odbcconf Load Response File id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml new file mode 100644 index 0000000000..52313880e5 --- /dev/null +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -0,0 +1,69 @@ +name: Windows Office Product Dropped Cab or Inf File +id: dbdd251e-dd45-4ec9-a555-f5e151391746 +version: 1 +date: '2025-01-20' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and Endpoint.Filesystem data models to identify Office applications creating these file types. This activity is significant as it may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector. If confirmed malicious, this could lead to remote code execution, allowing attackers to gain control over the affected system and potentially compromise sensitive data. +data_source: +- Sysmon EventID 1 AND Sysmon EventID 11 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: +- https://twitter.com/vxunderground/status/1436326057179860992?s=20 +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20 +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on $dest$ writing an inf or + cab file to this. This is not typical of $process_name$. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Compromised Windows Host + asset_type: Endpoint + cve: + - CVE-2021-40444 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml new file mode 100644 index 0000000000..bf3090d832 --- /dev/null +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -0,0 +1,64 @@ +name: Windows Office Product Dropped Uncommon File +id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 +version: 1 +date: '2025-01-20' +author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github +status: production +type: Anomaly +description: The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as ".exe", ".dll", or ".ps1". This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment. +data_source: +- Sysmon EventID 1 AND Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", "*.vbe", "*.vbs") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, process_guid | `windows_office_product_dropped_uncommon_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: office macro for automation may do this behavior +references: +- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation +- https://attack.mitre.org/groups/G0046/ +- https://www.joesandbox.com/analysis/702680/0/html +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: process $process_name$ drops a file $file_name$ in host $dest$ + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - CVE-2023-21716 Word RTF Heap Corruption + - Warzone RAT + - FIN7 + - Compromised Windows Host + - AgentTesla + - PlugX + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml new file mode 100644 index 0000000000..2d546a5b2b --- /dev/null +++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml @@ -0,0 +1,59 @@ +name: Windows Office Product Loaded MSHTML Module +id: 4cc015c9-687c-40d2-adcc-46350f66e10c +version: 1 +date: '2025-01-20' +author: Michael Haag, Mauricio Velazco, Splunk +status: production +type: Anomaly +description: The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in the MSHTML component via a malicious document. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network penetration. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventID=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loaded_mshtml_module_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Limited false positives will be present, however, tune as necessary. Some applications may legitimately load mshtml.dll. +references: +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://strontic.github.io/xcyclopedia/index-dll +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ loading + mshtml.dll. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + asset_type: Endpoint + cve: + - CVE-2021-40444 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml new file mode 100644 index 0000000000..b16c25faa3 --- /dev/null +++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml @@ -0,0 +1,52 @@ +name: Windows Office Product Loading Taskschd DLL +id: d7297cfa-1f04-4714-bfbe-3679e0666959 +version: 1 +date: '2025-01-20' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or by loading `taskschd.dll`. This detection leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` file. This activity is significant as it is a common technique used by malicious macro malware to establish persistence or initiate beaconing. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, or schedule future malicious activities, posing a significant threat to the environment. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime count by user_id, dest, process_name,loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_taskschd_dll_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: False positives may occur if legitimate office documents are creating scheduled tasks. Ensure to investigate the scheduled task and the command to be executed. If the task is benign, add the task name to the exclusion list. Some applications may legitimately load taskschd.dll. +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An Office document was identified creating a scheduled task on $dest$. + Investigate further. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml new file mode 100644 index 0000000000..d4aa93a79a --- /dev/null +++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml @@ -0,0 +1,63 @@ +name: Windows Office Product Loading VBE7 DLL +id: 7cfec906-2697-43f7-898b-83634a051d9a +version: 1 +date: '2025-01-20' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant because macros are a common attack vector for delivering malicious payloads, such as malware. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Disabling macros by default is recommended to mitigate this risk. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path IN ("*\\VBE7INTL.DLL", "*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by dest EventCode process_name process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_vbe7_dll_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: False positives may occur if legitimate office documents are executing macro code. Ensure to investigate the macro code and the command to be executed. If the macro code is benign, add the document name to the exclusion list. Some applications may legitimately load VBE7INTL.DLL, VBE7.DLL, or VBEUI.DLL. +references: +- https://www.joesandbox.com/analysis/386500/0/html +- https://www.joesandbox.com/analysis/702680/0/html +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +- https://www.fortinet.com/blog/threat-research/leveraging-microsoft-office-documents-to-deliver-agent-tesla-and-njrat +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office document executing a macro on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + - Trickbot + - IcedID + - DarkCrystal RAT + - AgentTesla + - Qakbot + - Azorult + - Remcos + - PlugX + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml new file mode 100644 index 0000000000..0b215898be --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -0,0 +1,55 @@ +name: Windows Office Product Spawned Child Process For Download +id: f02b64b8-cbea-4f75-bf77-7a05111566b1 +version: 1 +date: '2025-01-14' +author: Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic identifies Office applications spawning child processes to download content via HTTP/HTTPS. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications like Word or Excel initiate network connections, excluding common browsers. This activity is significant as it often indicates the use of malicious documents to execute living-off-the-land binaries (LOLBins) for payload delivery. If confirmed malicious, this behavior could lead to unauthorized code execution, data exfiltration, or further malware deployment, posing a severe threat to the organization's security. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Default browser not in the filter list. +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office document spawning suspicious child process on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - PlugX + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml new file mode 100644 index 0000000000..314783f994 --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -0,0 +1,86 @@ +name: Windows Office Product Spawned Control +id: 081c485d-ac8d-4bee-ad4c-525772fead4d +version: 2 +date: '2025-01-14' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic identifies instances where `control.exe` is spawned + by a Microsoft Office product. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process and parent process relationships. This activity + is significant because it can indicate exploitation attempts related to CVE-2021-40444, + where `control.exe` is used to execute malicious .cpl or .inf files. If confirmed + malicious, this behavior could allow an attacker to execute arbitrary code, potentially + leading to system compromise, data exfiltration, or further lateral movement within + the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_office_product_spawned_control_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Limited false positives should be present. +references: +- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://attack.mitre.org/techniques/T1218/011/ +- https://www.echotrail.io/insights/search/control.exe/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ clicking a suspicious attachment. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Compromised Windows Host + asset_type: Endpoint + cve: + - CVE-2021-40444 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml new file mode 100644 index 0000000000..446f762e55 --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -0,0 +1,89 @@ +name: Windows Office Product Spawned MSDT +id: a3148fad-3734-4b7f-9a71-62f08d39fab1 +version: 2 +date: '2025-01-14' +author: Michael Haag, Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects a Microsoft Office product spawning the + Windows msdt.exe process. This detection leverages data from Endpoint Detection + and Response (EDR) agents, focusing on process creation events where Office applications + are the parent process. This activity is significant as it may indicate an attempt + to exploit protocol handlers to bypass security controls, even if macros are disabled. + If confirmed malicious, this behavior could allow an attacker to execute arbitrary + code, potentially leading to system compromise, data exfiltration, or further lateral + movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_msdt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://isc.sans.edu/diary/rss/28694 +- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e +- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection +- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ has spawned a child process $process_name$ + on host $dest$. + risk_objects: + - field: user + type: user + score: 100 + - field: dest + type: system + score: 100 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Compromised Windows Host + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 + asset_type: Endpoint + cve: + - CVE-2022-30190 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml new file mode 100644 index 0000000000..21813278bb --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -0,0 +1,83 @@ +name: Windows Office Product Spawned Rundll32 With No DLL +id: f28e787e-69ca-480e-9f98-ab970e6d4bcc +version: 1 +date: '2025-01-14' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects any Windows Office Product spawning `rundll32.exe` + without a `.dll` file extension. This behavior is identified using Endpoint Detection + and Response (EDR) telemetry, focusing on process and parent process relationships. + This activity is significant as it is a known tactic of the IcedID malware family, + which can lead to unauthorized code execution. If confirmed malicious, this could + allow attackers to execute arbitrary code, potentially leading to data exfiltration, + system compromise, or further malware deployment. Immediate investigation and containment + are recommended. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` `process_rundll32` (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_rundll32_with_no_dll_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://www.joesandbox.com/analysis/395471/0/html +- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ +- https://any.run/malware-trends/icedid +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ observed executing a suspicious child + process $process_name$ with process id $process_id$ and no dll commandline $process$ + on host $dest$ + risk_objects: + - field: dest + type: system + score: 63 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - Compromised Windows Host + - Prestige Ransomware + - Graceful Wipe Out Attack + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml new file mode 100644 index 0000000000..5dc516ea3d --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -0,0 +1,109 @@ +name: Windows Office Product Spawned Uncommon Process +id: 55d8741c-fa32-4692-8109-410304961eb8 +version: 1 +date: '2025-01-13' +author: Michael Haag, Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects a Microsoft Office product spawning uncommon processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt of a malicious macro execution or exploitation of an unknown vulnerability in an office product, in order to bypass security controls. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` AND (`process_bitsadmin` OR `process_certutil` OR `process_cmd` OR `process_cscript` OR `process_mshta` OR `process_powershell` OR `process_regsvr32` OR `process_rundll32` OR `process_wmic` OR `process_wscript`) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_uncommon_process_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://any.run/malware-trends/trickbot +- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe +- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ +- https://attack.mitre.org/techniques/T1047/ +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md +- https://redcanary.com/threat-detection-report/threats/TA551/ +- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing +- https://www.joesandbox.com/analysis/380662/0/html +- https://www.joesandbox.com/analysis/702680/0/html +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - AgentTesla + - Azorult + - Compromised Windows Host + - CVE-2023-21716 Word RTF Heap Corruption + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - DarkCrystal RAT + - FIN7 + - IcedID + - NjRAT + - PlugX + - Qakbot + - Remcos + - Spearphishing Attachments + - Trickbot + - Warzone RAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test - Macro + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test - IcedId + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test - TrickBot + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_papercut_ng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml index 31198dc5a3..d647e50311 100644 --- a/detections/endpoint/windows_papercut_ng_spawn_shell.yml +++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml @@ -1,6 +1,6 @@ name: Windows PaperCut NG Spawn Shell id: a602d9a2-aaea-45f8-bf0f-d851168d61ca -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml new file mode 100644 index 0000000000..42bbaeb646 --- /dev/null +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -0,0 +1,34 @@ +name: Windows Password Policy Discovery with Net +id: e52f7865-be78-46bf-b7ed-150fbe447613 +version: 1 +date: '2025-01-13' +author: Teoderick Contreras, Mauricio Velazco, Nasreddine Bencherchali, Splunk +status: production +type: Hunting +description: The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts*" AND NOT Processes.process IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml new file mode 100644 index 0000000000..c22dd241a4 --- /dev/null +++ b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml @@ -0,0 +1,55 @@ +name: Windows Powershell Logoff User via Quser +id: 6d70780d-4cfe-4820-bafd-1b43941986b5 +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_source: +- Powershell Script Block Logging 4104 +type: Anomaly +status: production +description: The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. +search: '`powershell` EventCode=4104 ScriptBlockText = "*quser*logoff*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText UserID Computer + | rename Computer as dest, UserID as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_logoff_user_via_quser_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command. +references: +- https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Powershell process having commandline [$ScriptBlockText$] used to logoff user on [$dest$]. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1531 + - T1059.001 + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powersploit_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml index c0bc3bffb3..ab9be17dd3 100644 --- a/detections/endpoint/windows_powersploit_gpp_discovery.yml +++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml @@ -1,6 +1,6 @@ name: Windows PowerSploit GPP Discovery id: 0130a0df-83a1-4647-9011-841e950ff302 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml index 6b4490c90e..c94417e9e5 100644 --- a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml +++ b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml @@ -1,6 +1,6 @@ name: Windows Privilege Escalation Suspicious Process Elevation id: 6a80300a-9f8a-4f22-bd3e-09ca577cfdfc -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index 02c9d32e09..6ff6638edb 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -25,7 +25,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: Some security products or third party applications may utilize - CreateRemoteThread, filter as needed before enabling as a notable. + CreateRemoteThread, filter as needed. references: - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ tags: diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml index 3a6481da48..b55caf7791 100644 --- a/detections/endpoint/windows_protocol_tunneling_with_plink.yml +++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml @@ -1,6 +1,6 @@ name: Windows Protocol Tunneling with Plink id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index 4c61efa0c7..9e419ace18 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -1,6 +1,6 @@ name: Windows Raccine Scheduled Task Deletion id: c9f010da-57ab-11ec-82bd-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index f04f743ef0..47773b52e9 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -1,6 +1,6 @@ name: Windows Rasautou DLL Execution id: 6f42b8be-8e96-11ec-ad5a-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 512144998e..d6193ca528 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -23,8 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: This event is really notable but we found minimal number of - normal application from system32 folder like svchost.exe accessing it too. In this +known_false_positives: There are som minimal number of normal applications from system32 folder like svchost.exe accessing the MBR. In this case we used 'system32' and 'syswow64' path as a filter for this detection. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index f5262cc967..3692033d81 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -23,8 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: This event is really notable but we found minimal number of - normal application from system32 folder like svchost.exe accessing it too. In this +known_false_positives: There are som minimal number of normal applications from system32 folder like svchost.exe accessing the MBR. In this case we used 'system32' and 'syswow64' path as a filter for this detection. references: - https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index d938db4eac..256ee2f8e3 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -1,6 +1,6 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml new file mode 100644 index 0000000000..b19bc42c31 --- /dev/null +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -0,0 +1,38 @@ +name: Windows Registry Entries Exported Via Reg +id: 466379bc-0f47-476c-8202-16ef38112e0d +version: 1 +date: '2025-01-15' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects the execution of the reg.exe process with either the "save" or "export" parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" or "reg export" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process IN ("* save *", "* export *") by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_exported_via_reg_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. +references: +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser +- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +tags: + analytic_story: + - Windows Post-Exploitation + - CISA AA23-347A + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_registry_entries_restored_via_reg.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml new file mode 100644 index 0000000000..ae180959c0 --- /dev/null +++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml @@ -0,0 +1,37 @@ +name: Windows Registry Entries Restored Via Reg +id: a17af481-e2ad-494c-9da6-afb4d243a019 +version: 1 +date: '2025-01-14' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic detects the execution of reg.exe with the "restore" parameter, indicating an attempt to restore registry backup data on a host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate post-exploitation actions, such as those performed by tools like winpeas, which use "reg save" and "reg restore" to manipulate registry settings. If confirmed malicious, this could allow an attacker to revert registry changes, potentially bypassing security controls and maintaining persistence. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* restore *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_restored_via_reg_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. +references: +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser +- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +tags: + analytic_story: + - Windows Post-Exploitation + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index 90cb689064..e6810e6c34 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -1,6 +1,6 @@ name: Windows Remote Assistance Spawning Process id: ced50492-8849-11ec-9f68-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 93c28d5380..c963d8e1d7 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -1,6 +1,6 @@ name: Windows Remote Create Service id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_remote_management_execute_shell.yml b/detections/endpoint/windows_remote_management_execute_shell.yml new file mode 100644 index 0000000000..822b375a99 --- /dev/null +++ b/detections/endpoint/windows_remote_management_execute_shell.yml @@ -0,0 +1,55 @@ +name: Windows Remote Management Execute Shell +id: 28b80028-851d-4b8d-88a5-375ba115418a +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: Anomaly +status: production +description: The following analytic detects the execution of winrshost.exe initiating CMD or PowerShell processes as part of a potential payload execution. winrshost.exe is associated with Windows Remote Management (WinRM) and is typically used for remote execution. By monitoring for this behavior, the detection identifies instances where winrshost.exe is leveraged to run potentially malicious commands or payloads via CMD or PowerShell. This behavior may indicate exploitation of remote management tools for unauthorized access or lateral movement within a compromised environment, signaling a potential security incident. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name="winrshost.exe" AND Processes.process_name IN ("cmd.exe","*powershell*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_management_execute_shell_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: administrator or power user can execute command shell or script remotely using WINRM. +references: +- https://strontic.github.io/xcyclopedia/library/winrshost.exe-6790044CEB4BA5BE6AA8161460D990FD.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: a winrm remote proces [$parent_process_name$] execute [$process_name$] shell on [$dest$]. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + mitre_attack_id: + - T1021.006 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 0c8c2b33db..7817d86c25 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,7 +1,7 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 -version: 4 -date: '2024-11-13' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -60,9 +60,12 @@ rba: type: file_name tags: analytic_story: - - Chaos Ransomware - - NjRAT - PlugX + - Chaos Ransomware + - Derusbi + - Nexus APT Threat Activity + - Earth Estries + - NjRAT asset_type: Endpoint mitre_attack_id: - T1091 @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_rundll32_webdav_request.yml b/detections/endpoint/windows_rundll32_webdav_request.yml index ce111cff26..68ccb04ab4 100644 --- a/detections/endpoint/windows_rundll32_webdav_request.yml +++ b/detections/endpoint/windows_rundll32_webdav_request.yml @@ -1,6 +1,6 @@ name: Windows Rundll32 WebDAV Request id: 320099b7-7eb1-4153-a2b4-decb53267de2 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml index de78c6f02b..8ef7992823 100644 --- a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml +++ b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml @@ -1,6 +1,6 @@ name: Windows Rundll32 WebDav With Network Connection id: f03355e0-28b5-4e9b-815a-6adffc63b38c -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 83723be901..f673019307 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -35,7 +35,7 @@ known_false_positives: This detection may generate a few false positives, such a legitimate software updates or legitimate system maintenance activities that modify the RunMRU key. However, the exclusion of MRUList value changes helps reduce the number of false positives by focusing only on actual command entries. Add any specific - false positives to the built in filter to reduce notables as needed. + false positives to the built in filter to reduce findings as needed. references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml index 162d55c89d..c6f4d7a89c 100644 --- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml +++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml @@ -53,6 +53,7 @@ rba: threat_objects: [] tags: analytic_story: + - Crypto Stealer - Braodo Stealer asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml new file mode 100644 index 0000000000..6a7c924fe9 --- /dev/null +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -0,0 +1,59 @@ +name: Windows Sensitive Group Discovery With Net +id: d9eb7cda-5622-4722-bc88-7f2442f4b5af +version: 1 +date: '2025-01-13' +author: Mauricio Velazco, Splunk +status: production +type: Anomaly +description: The following analytic detects the execution of `net.exe` with command-line arguments used to query elevated domain or sensitive groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within Active Directory. If confirmed malicious, this behavior could lead to further attacks aimed at compromising privileged accounts, escalating privileges, or gaining unauthorized access to sensitive systems and data. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*", "*Domain Computers*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_group_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://adsecurity.org/?p=3658 +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Elevated domain group discovery enumeration on $dest$ by $user$ + risk_objects: + - field: dest + type: system + score: 21 + threat_objects: [] +tags: + analytic_story: + - Active Directory Discovery + - Volt Typhoon + - Rhysida Ransomware + - BlackSuit Ransomware + - IcedID + asset_type: Endpoint + mitre_attack_id: + - T1069 + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml new file mode 100644 index 0000000000..fe239f0596 --- /dev/null +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -0,0 +1,67 @@ +name: Windows Sensitive Registry Hive Dump Via CommandLine +id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e +version: 2 +date: '2025-01-15' +author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or `security` hives. This activity is significant as it indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. +references: +- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious use of `reg.exe` exporting Windows Registry hives containing + credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ + risk_objects: + - field: user + type: user + score: 56 + - field: dest + type: system + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name +tags: + analytic_story: + - CISA AA22-257A + - CISA AA23-347A + - Compromised Windows Host + - Credential Dumping + - DarkSide Ransomware + - Data Destruction + - Industroyer2 + - Volt Typhoon + - Windows Registry Abuse + asset_type: Endpoint + mitre_attack_id: + - T1003.002 + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test - Sysmon + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml index 64c9bcdd4f..ec7cef2ae6 100644 --- a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml +++ b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml @@ -1,6 +1,6 @@ name: Windows Server Software Component GACUtil Install to GAC id: 7c025ef0-9e65-4c57-be39-1c13dbb1613e -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index 150f198cc2..94c6c19992 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -1,6 +1,6 @@ name: Windows Service Create with Tscon id: c13b3d74-6b63-4db5-a841-4206f0370077 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index ee003d27ae..9dfedd34e8 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,7 +1,7 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: 8 -date: '2024-11-13' +version: 11 +date: '2025-01-27' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -54,14 +54,18 @@ rba: type: service tags: analytic_story: - - Clop Ransomware - - Active Directory Lateral Movement - Brute Ratel C4 - - Qakbot - - Snake Malware - Flax Typhoon - PlugX - CISA AA23-347A + - Qakbot + - Crypto Stealer + - Active Directory Lateral Movement + - Derusbi + - Nexus APT Threat Activity + - Snake Malware + - Clop Ransomware + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1569 @@ -74,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml.log source: XmlWinEventLog:System sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index ec2d6533fc..58eaf22cd4 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,10 +1,10 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 7 -date: '2024-12-08' +version: 11 +date: '2025-01-27' author: Teoderick Contreras, Splunk, Steven Dick status: production -type: TTP +type: Anomaly description: The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This @@ -53,13 +53,17 @@ rba: threat_objects: [] tags: analytic_story: - - Active Directory Lateral Movement - - Suspicious Windows Registry Activities - - Windows Persistence Techniques - - Windows Registry Abuse - Brute Ratel C4 - PlugX + - Windows Persistence Techniques - CISA AA23-347A + - Windows Registry Abuse + - Suspicious Windows Registry Activities + - Active Directory Lateral Movement + - Crypto Stealer + - Derusbi + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.011 @@ -71,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index 2b6c89b18c..cc12b5c252 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -55,8 +55,9 @@ rba: threat_objects: [] tags: analytic_story: - - Brute Ratel C4 - PlugX + - Crypto Stealer + - Brute Ratel C4 asset_type: Endpoint mitre_attack_id: - T1489 diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index 01840501c6..43198428c0 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -1,6 +1,6 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 -version: 2 +version: 3 date: '2025-01-07' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml new file mode 100644 index 0000000000..86253b0dc4 --- /dev/null +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -0,0 +1,50 @@ +name: Windows Service Stop Attempt +id: dd0f07ea-f08f-4d88-96e5-cb58156e82b6 +version: 1 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +description: The following analytic identifies attempts to stop services on a system using `net.exe`, `sc.exe` or the "Stop-Service" cmdlet. It leverages Endpoint Detection and Response (EDR) telemetry. This activity can be significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Windows OS or software may stop and restart services due to some critical update. +references: +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Prestige Ransomware + - Graceful Wipe Out Attack + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index 6fac46c5a3..fc838572a7 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -65,6 +65,7 @@ tags: analytic_story: - Azorult - Graceful Wipe Out Attack + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1489 diff --git a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml new file mode 100644 index 0000000000..9224034cad --- /dev/null +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -0,0 +1,80 @@ +name: Windows Set Account Password Policy To Unlimited Via Net +id: 11f93009-8083-43fd-82a7-821fcbdc8342 +version: 1 +date: '2025-01-13' +author: Teoderick Contreras, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of net.exe to update user account + policies to set passwords as non-expiring. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" or "/maxpwage:49710", which achieve a similar outcome theoretically. + This activity is significant as it can indicate an attempt to maintain persistence, + escalate privileges, evade defenses, or facilitate lateral movement. If confirmed + malicious, this behavior could allow an attacker to maintain long-term access to + compromised accounts, potentially leading to further exploitation and unauthorized + access to sensitive information. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` AND Processes.process="* accounts *" AND (Processes.process="* + /maxpwage:unlimited" OR Processes.process="/maxpwage:49710") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: This behavior is not commonly seen in production environment + and not advisable, filter as needed. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to make non-expiring password on host user accounts. + risk_objects: + - field: dest + type: system + score: 100 + threat_objects: [] +tags: + analytic_story: + - Ransomware + - BlackByte Ransomware + - Crypto Stealer + - XMRig + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml index f2e58cc866..d612a17e7e 100644 --- a/detections/endpoint/windows_sql_spawning_certutil.yml +++ b/detections/endpoint/windows_sql_spawning_certutil.yml @@ -1,6 +1,6 @@ name: Windows SQL Spawning CertUtil id: dfc18a5a-946e-44ee-a373-c0f60d06e676 -version: 6 +version: 7 date: '2024-12-16' author: Michael Haag, Splunk status: experimental diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml index f62cbf81c9..10ca564046 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates - ESC1 Abuse id: cbe761fc-d945-4c8c-a71d-e26d12255d32 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml index 725f04e04e..5fcaaba267 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates - ESC1 Authentication id: f0306acf-a6ab-437a-bbc6-8628f8d5c97e -version: 5 +version: 6 date: '2024-12-10' author: Steven Dick status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml index bf954e1d52..9e7ceb2759 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates CertUtil Backup id: bac85b56-0b65-4ce5-aad5-d94880df0967 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index d1a5eb3d7b..af44db774c 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates Export Certificate id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index 459417802e..2e01886698 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates Export PfxCertificate id: 391329f3-c14b-4b8d-8b37-ac5012637360 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index 3b28765cce..a9ace2226c 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -1,6 +1,6 @@ name: Windows Suspect Process With Authentication Traffic id: 953322db-128a-4ce9-8e89-56e039e33d98 -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml new file mode 100644 index 0000000000..57257bec13 --- /dev/null +++ b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml @@ -0,0 +1,103 @@ +name: Windows Suspicious Child Process Spawned From WebServer +id: 2d4470ef-7158-4b47-b68b-1f7f16382156 +version: 1 +date: '2025-01-13' +author: Steven Dick +status: production +type: TTP +description: The following analytic identifies the execution of suspicious processes + typically associated with WebShell activity on web servers. It detects when processes + like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes + such as `w3wp.exe` or `nginx.exe`. This behavior is significant as it may indicate + an adversary exploiting a web application vulnerability to install a WebShell, providing + persistent access and command execution capabilities. If confirmed malicious, this + activity could allow attackers to maintain control over the compromised server, + execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive + data. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) + as firstTime from datamodel=Endpoint.Processes where (Processes.process_name IN + ("arp.exe","at.exe","bash.exe","bitsadmin.exe","certutil.exe","cmd.exe","cscript.exe", + "dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","ksh.exe","nbstat.exe", + "net.exe","net1.exe","netdom.exe","netsh.exe","netstat.exe","nltest.exe","nslookup.exe","ntdsutil.exe","pathping.exe", + "ping.exe","powershell.exe","pwsh.exe","qprocess.exe","query.exe","qwinsta.exe","reg.exe","rundll32.exe","sc.exe", + "scrcons.exe","schtasks.exe","sh.exe","systeminfo.exe","tasklist.exe","tracert.exe","ver.exe","vssadmin.exe", + "wevtutil.exe","whoami.exe","wmic.exe","wscript.exe","wusa.exe","zsh.exe") AND Processes.parent_process_name + IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe","tomcat*.exe")) + by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_process_name,Processes.process,Processes.process_name + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_suspicious_child_process_spawned_from_webserver_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Legitimate OS functions called by vendor applications, baseline + the environment and filter before enabling. Recommend throttle by dest/process_name +references: +- https://attack.mitre.org/techniques/T1505/003/ +- https://github.com/nsacyber/Mitigating-Web-Shells +- https://www.hackingarticles.in/multiple-ways-to-exploit-tomcat-manager/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Webshell Exploit Behavior - $parent_process_name$ spawned $process_name$ + on $dest$. + risk_objects: + - field: user + type: user + score: 80 + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - ProxyNotShell + - CISA AA22-257A + - HAFNIUM Group + - Citrix ShareFile RCE CVE-2023-24489 + - ProxyShell + - Flax Typhoon + - CISA AA22-264A + - SysAid On-Prem Software CVE-2023-47246 Vulnerability + - Compromised Windows Host + - WS FTP Server Critical Vulnerabilities + - BlackByte Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1505 + - T1505.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 115d30093e..318fc412e7 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -1,6 +1,6 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml index ab13833230..8550359fdd 100644 --- a/detections/endpoint/windows_system_file_on_disk.yml +++ b/detections/endpoint/windows_system_file_on_disk.yml @@ -24,14 +24,15 @@ how_to_implement: To successfully implement this search you need to be ingesting In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). - This will level out the noise generated to potentally lead to generating notables. + This will level out the noise generated to potentally lead to generating findings. known_false_positives: False positives will be present. Filter as needed. references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ tags: analytic_story: - - Windows Drivers - CISA AA22-264A + - Windows Drivers + - Crypto Stealer asset_type: Endpoint mitre_attack_id: - T1068 diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 40f299551f..151b86c366 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -1,6 +1,6 @@ name: Windows System Script Proxy Execution Syncappvpublishingserver id: 8dd73f89-682d-444c-8b41-8e679966ad3c -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index 87d9ae8aac..4febcf1910 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -41,8 +41,9 @@ references: - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ tags: analytic_story: - - Windows Post-Exploitation - Prestige Ransomware + - Crypto Stealer + - Windows Post-Exploitation asset_type: Endpoint mitre_attack_id: - T1033 diff --git a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml index ffd2829b98..7921f897c6 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml @@ -1,6 +1,6 @@ name: Windows UAC Bypass Suspicious Child Process id: 453a6b0f-b0ea-48fa-9cf4-20537ffdd22c -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml index 29e8eca705..977a72aeee 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml @@ -1,6 +1,6 @@ name: Windows UAC Bypass Suspicious Escalation Behavior id: 00d050d3-a5b4-4565-a6a5-a31f69681dc3 -version: 5 +version: 6 date: '2024-12-10' author: Steven Dick status: production diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 4f80f0618c..f6c7a56920 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: 4 -date: '2024-11-13' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,9 @@ rba: tags: analytic_story: - Warzone RAT + - Derusbi + - Nexus APT Threat Activity + - Earth Estries - NjRAT asset_type: Endpoint mitre_attack_id: @@ -64,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index b9163ad484..08803a7cd9 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 3 -date: '2024-11-13' +version: 6 +date: '2025-01-27' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -54,8 +54,11 @@ rba: threat_objects: [] tags: analytic_story: - - DarkGate Malware - PlugX + - Derusbi + - Nexus APT Threat Activity + - DarkGate Malware + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.002 @@ -68,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 1db59b0464..add7f13b4d 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: 4 -date: '2024-11-13' +version: 7 +date: '2025-01-27' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -64,7 +64,10 @@ rba: type: file_name tags: analytic_story: + - Derusbi - APT29 Diplomatic Deceptions with WINELOADER + - Nexus APT Threat Activity + - Earth Estries group: - APT29 - Cozy Bear @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/windows_user_deletion_via_net.yml b/detections/endpoint/windows_user_deletion_via_net.yml new file mode 100644 index 0000000000..32bb43dd91 --- /dev/null +++ b/detections/endpoint/windows_user_deletion_via_net.yml @@ -0,0 +1,66 @@ +name: Windows User Deletion Via Net +id: b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e +version: 2 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts or cover tracks during lateral movement. If confirmed malicious, this could lead to unauthorized access removal, disruption of legitimate user activities, or concealment of adversarial actions, complicating incident response and forensic investigations. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/delete*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_deletion_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to delete accounts. + risk_objects: + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - XMRig + - Graceful Wipe Out Attack + - DarkGate Malware + asset_type: Endpoint + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_user_disabled_via_net.yml b/detections/endpoint/windows_user_disabled_via_net.yml new file mode 100644 index 0000000000..547248419e --- /dev/null +++ b/detections/endpoint/windows_user_disabled_via_net.yml @@ -0,0 +1,64 @@ +name: Windows User Disabled Via Net +id: b0359e05-c87b-4354-83d8-aee0d890243f +version: 2 +date: '2025-01-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: The following analytic detects the use of the `net.exe` utility to disable a user account via the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate an adversary's attempt to disrupt user availability, potentially as a precursor to further malicious actions. If confirmed malicious, this could lead to denial of service for legitimate users, aiding the attacker in maintaining control or covering their tracks. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/active:no*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_disabled_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + disabling a user account on endpoint $dest$ by user $user$. + risk_objects: + - field: user + type: user + score: 42 + - field: dest + type: system + score: 42 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - XMRig + asset_type: Endpoint + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_user_discovery_via_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml new file mode 100644 index 0000000000..9f736b6b2d --- /dev/null +++ b/detections/endpoint/windows_user_discovery_via_net.yml @@ -0,0 +1,44 @@ +name: Windows User Discovery Via Net +id: 7742987e-88c1-476b-a626-a869e088ab72 +version: 1 +date: '2025-01-13' +author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk +status: production +type: Hunting +description: The following analytic detects the execution of `net.exe` or `net1.exe` + with command-line arguments `user` or `users` to query local user accounts. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on process names + and command-line executions. This activity is significant as it indicates potential + reconnaissance efforts by adversaries to enumerate local users, which is a common + step in situational awareness and Active Directory discovery. If confirmed malicious, + this behavior could lead to further attacks, including privilege escalation and + lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process="*user" OR Processes.process="*users" OR Processes.process="*users *" OR Processes.process="*user *") AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_discovery_via_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ +tags: + analytic_story: + - Active Directory Discovery + - Sandworm Tools + asset_type: Endpoint + mitre_attack_id: + - T1087 + - T1087.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_windbg_spawning_autoit3.yml b/detections/endpoint/windows_windbg_spawning_autoit3.yml index ddf09e5373..323c29de1d 100644 --- a/detections/endpoint/windows_windbg_spawning_autoit3.yml +++ b/detections/endpoint/windows_windbg_spawning_autoit3.yml @@ -1,6 +1,6 @@ name: Windows WinDBG Spawning AutoIt3 id: 7aec015b-cd69-46c3-85ed-dac152056aa4 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 38172807f5..690c5bffb5 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created to Spawn Shell id: 203ef0ea-9bd8-11eb-8201-acde48001122 -version: 7 -date: '2024-12-10' +version: 8 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -55,13 +55,15 @@ rba: tags: analytic_story: - Windows Persistence Techniques - - Windows Error Reporting Service Elevation of Privilege Vulnerability - - CISA AA22-257A - - Ryuk Ransomware - Ransomware + - Windows Error Reporting Service Elevation of Privilege Vulnerability - Scheduled Tasks - - Compromised Windows Host - Winter Vivern + - Nexus APT Threat Activity + - Compromised Windows Host + - Ryuk Ransomware + - Earth Estries + - CISA AA22-257A asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index b860a33f55..7c383641be 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created Within Public Path id: 5d9c6eee-988c-11eb-8253-acde48001122 -version: 7 -date: '2024-12-10' +version: 8 +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -54,20 +54,22 @@ rba: threat_objects: [] tags: analytic_story: - - Windows Persistence Techniques - - Active Directory Lateral Movement - - CISA AA22-257A - - IcedID - - Prestige Ransomware - - Industroyer2 - - Ryuk Ransomware - - AsyncRAT - Data Destruction - - Ransomware + - Windows Persistence Techniques + - AsyncRAT + - Industroyer2 - CISA AA23-347A + - Ransomware + - Prestige Ransomware - Scheduled Tasks - - Compromised Windows Host + - IcedID - Winter Vivern + - Active Directory Lateral Movement + - Nexus APT Threat Activity + - Compromised Windows Host + - Ryuk Ransomware + - Earth Estries + - CISA AA22-257A asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -80,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 97671e24f0..71018871f9 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Winhlp32 Spawning a Process id: d17dae9e-2618-11ec-b9f5-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/winrar_spawning_shell_application.yml b/detections/endpoint/winrar_spawning_shell_application.yml index 9ef1be04ff..104bc4f1d3 100644 --- a/detections/endpoint/winrar_spawning_shell_application.yml +++ b/detections/endpoint/winrar_spawning_shell_application.yml @@ -1,6 +1,6 @@ name: WinRAR Spawning Shell Application id: d2f36034-37fa-4bd4-8801-26807c15540f -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index b8efe7f1fc..a9fa113597 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -1,6 +1,6 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 9e5b661f0f..475bc420de 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -48,8 +48,9 @@ rba: threat_objects: [] tags: analytic_story: - - XMRig - CISA AA22-320A + - Crypto Stealer + - XMRig asset_type: Endpoint mitre_attack_id: - T1543.003 diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 02f24699a2..28584c4d66 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -1,6 +1,6 @@ name: XSL Script Execution With WMIC id: 004e32e2-146d-11ec-a83f-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index c8886d955a..c5f4d94b92 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -26,13 +26,12 @@ how_to_implement: "First, you'll need to ingest data from your DNS operations. T which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of `dynamic_dns_providers_local.csv`.\n This search produces fields (query, answer, isDynDNS) that are not yet supported - by ES Incident Review and therefore cannot be viewed when a notable event is raised. - These fields contribute additional context to the notable event. To see the additional + by ES Incident Review and therefore cannot be viewed when a finding is raised. + These fields contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Incident Review. Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n* **Label:** DNS Query, **Field:** query\n* **Label:** DNS Answer, - **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS\nDetailed documentation - on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`" + **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS\n" known_false_positives: Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified. diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index 75813bbf1a..9fa1a7f4b5 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -1,7 +1,7 @@ name: Detect Large Outbound ICMP Packets id: e9c102de-4d43-42a7-b1c8-8062ea297419 -version: 7 -date: '2024-11-15' +version: 9 +date: '2025-01-27' author: Rico Valdez, Dean Luxton, Splunk status: production type: TTP @@ -15,25 +15,23 @@ description: The following analytic identifies outbound ICMP packets with a size the network. data_source: - Palo Alto Network Traffic -search: >- - | tstats `security_content_summariesonly` count earliest(_time) as firstTime - latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes) - as bytes from - datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp - OR All_Traffic.transport=icmp) All_Traffic.bytes - > 1000 AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") - by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.protocol - | `drop_dm_object_name("All_Traffic")` | iplocation dest_ip | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `detect_large_outbound_icmp_packets_filter` -how_to_implement: "In order to run this search effectively, we highly recommend that +search: "| tstats `security_content_summariesonly` count earliest(_time) as firstTime\n\ + \ latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes)\n\ + as bytes from\n datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp\n\ + OR All_Traffic.transport=icmp) All_Traffic.bytes\n > 1000 AND NOT All_Traffic.dest_ip\ + \ IN (\"10.0.0.0/8\",\"172.16.0.0/12\",\"192.168.0.0/16\")\nby All_Traffic.src_ip\ + \ All_Traffic.dest_ip All_Traffic.protocol | `drop_dm_object_name(\"All_Traffic\"\ + )` | iplocation dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ + \ | `detect_large_outbound_icmp_packets_filter`" +how_to_implement: 'In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have a good understanding of how your network segments are designed and that you are able to distinguish internal from external address space. Add a category named `internal` - to the CIDRs that host the company's assets in the `assets_by_cidr.csv` lookup file, - which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More - information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. + to the CIDRs that host the company''s assets in the `assets_by_cidr.csv` lookup + file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. + More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating - the Network_Traffic data model" + the Network_Traffic data model' known_false_positives: ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are @@ -68,6 +66,8 @@ rba: threat_objects: [] tags: analytic_story: + - Backdoor Pingpong + - Nexus APT Threat Activity - Command And Control asset_type: Endpoint mitre_attack_id: @@ -80,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1095/palologs/large_icmp.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1095/palologs/large_icmp.log sourcetype: pan:traffic source: pan:traffic diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index 3f581ed759..3a2cbf6989 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -30,7 +30,7 @@ how_to_implement: This search also requires you to be ingesting your network tra known_false_positives: It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company's internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as `internal` in the - lookup file to avoid creating notable events for traffic destined to those CIDR + lookup file to avoid creating findings for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary. diff --git a/detections/network/dns_query_length_outliers___mltk.yml b/detections/network/dns_query_length_outliers___mltk.yml index 0aad3d7e34..629215e272 100644 --- a/detections/network/dns_query_length_outliers___mltk.yml +++ b/detections/network/dns_query_length_outliers___mltk.yml @@ -31,13 +31,12 @@ how_to_implement: "To successfully implement this search, you will need to ensur available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.\nThis search produces fields (`query`,`query_length`,`count`) that are not yet supported by ES Incident - Review and therefore cannot be viewed when a notable event is raised. These fields - contribute additional context to the notable. To see the additional metadata, add + Review and therefore cannot be viewed when a finding event is raised. These fields + contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n * **Label:** DNS Query, **Field:** query\n* **Label:** DNS Query Length, **Field:** - query_length\n* **Label:** Number of events, **Field:** count\nDetailed documentation - on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`" + query_length\n* **Label:** Number of events, **Field:** count\n" known_false_positives: If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. diff --git a/detections/network/smb_traffic_spike___mltk.yml b/detections/network/smb_traffic_spike___mltk.yml index f8b5a6e950..0ec7d9fe16 100644 --- a/detections/network/smb_traffic_spike___mltk.yml +++ b/detections/network/smb_traffic_spike___mltk.yml @@ -31,12 +31,11 @@ how_to_implement: "To successfully implement this search, you will need to ensur should periodically re-run the support search to rebuild the model with the latest data available in your environment.\nThis search produces a field (Number of events,count) that are not yet supported by ES Incident Review and therefore cannot be viewed - when a notable event is raised. This field contributes additional context to the - notable. To see the additional metadata, add the following field, if not already + when a finding is raised. This field contributes additional context to the + finding. To see the additional metadata, add the following field, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n* **Label:** Number of events, **Field:** - count\nDetailed documentation on how to create a new field within Incident Review - is found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`" + count" known_false_positives: If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. Please update diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index d60f2af086..4e51d42198 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 5 +version: 6 date: '2024-11-15' author: Steven Dick status: production diff --git a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml index f9e9808237..d9b87dfcf0 100644 --- a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml +++ b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml @@ -33,7 +33,7 @@ how_to_implement: To implement, one must be collecting network traffic that is n and tie to a specific network source type to hunt in. Tune as needed, or remove the other_lookups statement. known_false_positives: False positives are present when the values are set to 1 for - utf and lookup. It's possible to raise this to TTP (direct notable) if removal of + utf and lookup. It's possible to raise this to TTP (direct finding) if removal of other_lookups occur and Score is raised to 2 (down from 4). references: - https://sysdig.com/blog/cve-2022-42889-text4shell/ diff --git a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml index fa288f0f1c..9b10539657 100644 --- a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml +++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml @@ -1,30 +1,25 @@ name: Windows Exchange Autodiscover SSRF Abuse id: d436f9e7-0ee7-4a47-864b-6dea2c4e2752 version: 4 -date: '2024-11-15' +date: '2025-01-16' author: Michael Haag, Nathaniel Stearns, Splunk status: production type: TTP -description: The following analytic detects potential abuse of the ProxyShell or ProxyNotShell - vulnerabilities in Microsoft Exchange via Server Side Request Forgery (SSRF). It - leverages the Web datamodel to identify suspicious POST requests with specific URI - paths and queries related to autodiscover, powershell, and mapi. This activity is - significant as it may indicate an attempt to exploit Exchange server vulnerabilities - to access internal services or sensitive data. If confirmed malicious, this could - lead to unauthorized access, data exfiltration, or further compromise of the network. +description: This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server. The detection focuses on identifying the SSRF attack patterns used in these exploit chains. The analytic monitors for suspicious POST requests to /autodiscover/autodiscover.json endpoints that may indicate attempts to enumerate LegacyDN attributes as part of initial reconnaissance. It also detects requests containing X-Rps-CAT parameters that could indicate attempts to impersonate Exchange users and access the PowerShell backend. Additionally, it looks for MAPI requests that may be used to obtain user SIDs, along with suspicious user agents (particularly Python-based) commonly used in automated exploit attempts. If successful, these attacks can lead to remote code execution as SYSTEM, allowing attackers to deploy webshells, access mailboxes, or gain persistent access to the Exchange server and potentially the broader network environment. data_source: - Windows IIS -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where (Web.status=200 OR Web.status=302 OR Web.status=401) - AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method - Web.uri_query | `drop_dm_object_name("Web")` | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover%"),1,0) - | eval powershell = if(match(lower(uri_query),"powershell"), "1",0) | eval mapi=if(like(uri_query,"%/mapi/%"),1,0) - | addtotals fieldname=Score is_autodiscover, powershell, mapi | fields Score, src,dest, - status, uri_query,uri_path,http_method | where Score >= 2 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_exchange_autodiscover_ssrf_abuse_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. - In addition, confirm the latest CIM App 4.20 or higher is installed. +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.status=200) AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method Web.uri_query Web.http_user_agent + | `drop_dm_object_name("Web")` + | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover/autodiscover.json%"),1,0) + | eval has_rps_cat=if(like(lower(uri_query),"%x-rps-cat=%"),1,0) + | eval exchange_backend=if(like(lower(uri_query),"%/powershell/?%"),1,0) + | eval mapi=if(like(uri_query,"%/mapi/%"),1,0) + | eval suspicious_agent=if(match(lower(http_user_agent), "python|urllib"),1,0) + | addtotals fieldname=Score is_autodiscover, has_rps_cat, exchange_backend, mapi, suspicious_agent + | where Score >= 3 + | fields Score, src, dest, status, uri_query, uri_path, http_method, http_user_agent + | `windows_exchange_autodiscover_ssrf_abuse_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed. known_false_positives: False positives are limited. references: - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html @@ -36,6 +31,7 @@ references: - https://docs.splunk.com/Documentation/AddOns/released/MSIIS - https://highon.coffee/blog/ssrf-cheat-sheet/ - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ +- https://m365internals.com/2022/10/18/hunting-and-responding-to-proxyshell-attacks/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/web/zscaler_adware_activities_threat_blocked.yml b/detections/web/zscaler_adware_activities_threat_blocked.yml index f662cc0a16..c47abd8740 100644 --- a/detections/web/zscaler_adware_activities_threat_blocked.yml +++ b/detections/web/zscaler_adware_activities_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Adware Activities Threat Blocked id: 3407b250-345a-4d71-80db-c91e555a3ece -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_behavior_analysis_threat_blocked.yml b/detections/web/zscaler_behavior_analysis_threat_blocked.yml index 8875d8762b..8a55d3f407 100644 --- a/detections/web/zscaler_behavior_analysis_threat_blocked.yml +++ b/detections/web/zscaler_behavior_analysis_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Behavior Analysis Threat Blocked id: 289ad59f-8939-4331-b805-f2bd51d36fb8 -version: 4 +version: 5 date: '2024-11-15' author: Rod Soto, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_exploit_threat_blocked.yml b/detections/web/zscaler_exploit_threat_blocked.yml index 0da0906592..e88d087743 100644 --- a/detections/web/zscaler_exploit_threat_blocked.yml +++ b/detections/web/zscaler_exploit_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Exploit Threat Blocked id: 94665d8c-b841-4ff4-acb4-34d613e2cbfe -version: 4 +version: 5 date: '2024-11-15' author: Rod Soto, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_malware_activity_threat_blocked.yml b/detections/web/zscaler_malware_activity_threat_blocked.yml index 3494bd9e23..34061dc5be 100644 --- a/detections/web/zscaler_malware_activity_threat_blocked.yml +++ b/detections/web/zscaler_malware_activity_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Malware Activity Threat Blocked id: ae874ad8-e353-40a7-87d4-420cdfb27d1a -version: 4 +version: 5 date: '2024-11-15' author: Rod Soto, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_potentially_abused_file_download.yml b/detections/web/zscaler_potentially_abused_file_download.yml index 040b02ae71..f18bdfe4f0 100644 --- a/detections/web/zscaler_potentially_abused_file_download.yml +++ b/detections/web/zscaler_potentially_abused_file_download.yml @@ -1,6 +1,6 @@ name: Zscaler Potentially Abused File Download id: b0c21379-f4ba-4bac-a958-897e260f964a -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production diff --git a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml index cad5f20065..abf94751e3 100644 --- a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml +++ b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Privacy Risk Destinations Threat Blocked id: 5456bdef-d765-4565-8e1f-61ca027bc50d -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production diff --git a/detections/web/zscaler_scam_destinations_threat_blocked.yml b/detections/web/zscaler_scam_destinations_threat_blocked.yml index d91cf5e7e9..5c7281924b 100644 --- a/detections/web/zscaler_scam_destinations_threat_blocked.yml +++ b/detections/web/zscaler_scam_destinations_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Scam Destinations Threat Blocked id: a0c21379-f4ba-4bac-a958-897e260f964a -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production diff --git a/detections/web/zscaler_virus_download_threat_blocked.yml b/detections/web/zscaler_virus_download_threat_blocked.yml index 656efd2fac..f0c094a07c 100644 --- a/detections/web/zscaler_virus_download_threat_blocked.yml +++ b/detections/web/zscaler_virus_download_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Virus Download threat blocked id: aa19e627-d448-4a31-85cd-82068dec5691 -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production diff --git a/investigations/all_backup_logs_for_host.yml b/investigations/all_backup_logs_for_host.yml index fb5ceeefa9..526e0760f2 100644 --- a/investigations/all_backup_logs_for_host.yml +++ b/investigations/all_backup_logs_for_host.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-12' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. search: '| search `netbackup` dest=$dest$' diff --git a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml b/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml index 549b3eec93..fdd85fd8e0 100644 --- a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml +++ b/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation +status: deprecated description: This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/aws_investigate_security_hub_alerts_by_dest.yml b/investigations/aws_investigate_security_hub_alerts_by_dest.yml index c000401848..c68fadb66c 100644 --- a/investigations/aws_investigate_security_hub_alerts_by_dest.yml +++ b/investigations/aws_investigate_security_hub_alerts_by_dest.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-06-08' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | diff --git a/investigations/aws_investigate_user_activities_by_accesskeyid.yml b/investigations/aws_investigate_user_activities_by_accesskeyid.yml index 52a16896d9..c9523dd2fd 100644 --- a/investigations/aws_investigate_user_activities_by_accesskeyid.yml +++ b/investigations/aws_investigate_user_activities_by_accesskeyid.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-08' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ diff --git a/investigations/aws_investigate_user_activities_by_arn.yml b/investigations/aws_investigate_user_activities_by_arn.yml index 6c928258e1..d15290547a 100644 --- a/investigations/aws_investigate_user_activities_by_arn.yml +++ b/investigations/aws_investigate_user_activities_by_arn.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-30' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's diff --git a/investigations/aws_network_acl_details_from_id.yml b/investigations/aws_network_acl_details_from_id.yml index 2e54e32512..71ef17baf8 100644 --- a/investigations/aws_network_acl_details_from_id.yml +++ b/investigations/aws_network_acl_details_from_id.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-01-22' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ diff --git a/investigations/aws_network_interface_details_via_resourceid.yml b/investigations/aws_network_interface_details_via_resourceid.yml index 7ed717720b..081ba1bdc4 100644 --- a/investigations/aws_network_interface_details_via_resourceid.yml +++ b/investigations/aws_network_interface_details_via_resourceid.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, diff --git a/investigations/aws_s3_bucket_details_via_bucketname.yml b/investigations/aws_s3_bucket_details_via_bucketname.yml index 875ea0b095..86946b4438 100644 --- a/investigations/aws_s3_bucket_details_via_bucketname.yml +++ b/investigations/aws_s3_bucket_details_via_bucketname.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-26' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, diff --git a/investigations/gcp_kubernetes_activity_by_src_ip.yml b/investigations/gcp_kubernetes_activity_by_src_ip.yml index df57d09804..d4359faeb0 100644 --- a/investigations/gcp_kubernetes_activity_by_src_ip.yml +++ b/investigations/gcp_kubernetes_activity_by_src_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation +status: deprecated description: This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/get_all_aws_activity_from_city.yml b/investigations/get_all_aws_activity_from_city.yml index 80cc059499..4e9d0f79a9 100644 --- a/investigations/get_all_aws_activity_from_city.yml +++ b/investigations/get_all_aws_activity_from_city.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_country.yml b/investigations/get_all_aws_activity_from_country.yml index e7b9c1124a..aef67b8395 100644 --- a/investigations/get_all_aws_activity_from_country.yml +++ b/investigations/get_all_aws_activity_from_country.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether diff --git a/investigations/get_all_aws_activity_from_ip_address.yml b/investigations/get_all_aws_activity_from_ip_address.yml index ec81104fc7..ad00e31621 100644 --- a/investigations/get_all_aws_activity_from_ip_address.yml +++ b/investigations/get_all_aws_activity_from_ip_address.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_region.yml b/investigations/get_all_aws_activity_from_region.yml index a6e53b8bde..a9be04ab63 100644 --- a/investigations/get_all_aws_activity_from_region.yml +++ b/investigations/get_all_aws_activity_from_region.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API diff --git a/investigations/get_backup_logs_for_endpoint.yml b/investigations/get_backup_logs_for_endpoint.yml index c1bd52ccac..92c86ed03a 100644 --- a/investigations/get_backup_logs_for_endpoint.yml +++ b/investigations/get_backup_logs_for_endpoint.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as diff --git a/investigations/get_certificate_logs_for_a_domain.yml b/investigations/get_certificate_logs_for_a_domain.yml index 932ed57c66..f0b2aa4a3d 100644 --- a/investigations/get_certificate_logs_for_a_domain.yml +++ b/investigations/get_certificate_logs_for_a_domain.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-29' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. diff --git a/investigations/get_dns_server_history_for_a_host.yml b/investigations/get_dns_server_history_for_a_host.yml index 53ebad3fa0..58ba43d1c1 100644 --- a/investigations/get_dns_server_history_for_a_host.yml +++ b/investigations/get_dns_server_history_for_a_host.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular diff --git a/investigations/get_dns_traffic_ratio.yml b/investigations/get_dns_traffic_ratio.yml index b9da20a5e3..ede0480799 100644 --- a/investigations/get_dns_traffic_ratio.yml +++ b/investigations/get_dns_traffic_ratio.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a diff --git a/investigations/get_ec2_instance_details_by_instanceid.yml b/investigations/get_ec2_instance_details_by_instanceid.yml index 41faacccf5..ed0ddf0c52 100644 --- a/investigations/get_ec2_instance_details_by_instanceid.yml +++ b/investigations/get_ec2_instance_details_by_instanceid.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-02-12' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS description logs and returns all the information about a specific instance via the instanceId field search: '`aws_description` | dedup id sortby -_time |rename id as instanceId| search diff --git a/investigations/get_ec2_launch_details.yml b/investigations/get_ec2_launch_details.yml index 9eced4ac58..46432d9945 100644 --- a/investigations/get_ec2_launch_details.yml +++ b/investigations/get_ec2_launch_details.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-12' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search returns some of the launch details for a EC2 instance. search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, diff --git a/investigations/get_email_info.yml b/investigations/get_email_info.yml index 778409bb43..247576a7cc 100644 --- a/investigations/get_email_info.yml +++ b/investigations/get_email_info.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search returns all the information Splunk might have collected a specific email message over the last 2 hours. search: '| from datamodel Email.All_Email | search message_id=$message_id$' diff --git a/investigations/get_emails_from_specific_sender.yml b/investigations/get_emails_from_specific_sender.yml index 109bbb8bf7..c4e5b0389a 100644 --- a/investigations/get_emails_from_specific_sender.yml +++ b/investigations/get_emails_from_specific_sender.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-11-09' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search returns all the emails from a specific sender over the last 24 and next hours. search: '| from datamodel Email.All_Email | search src_user=$src_user$' diff --git a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml index 12c8480ae1..22da000f97 100644 --- a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ b/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with diff --git a/investigations/get_history_of_email_sources.yml b/investigations/get_history_of_email_sources.yml index b5ab421254..6b5b7d83af 100644 --- a/investigations/get_history_of_email_sources.yml +++ b/investigations/get_history_of_email_sources.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-02-21' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. diff --git a/investigations/get_logon_rights_modifications_for_endpoint.yml b/investigations/get_logon_rights_modifications_for_endpoint.yml index 62a1483ba5..42405d395a 100644 --- a/investigations/get_logon_rights_modifications_for_endpoint.yml +++ b/investigations/get_logon_rights_modifications_for_endpoint.yml @@ -4,6 +4,7 @@ version: 2 date: '2017-09-12' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search allows you to retrieve any modifications to logon rights associated with a specific host. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ diff --git a/investigations/get_logon_rights_modifications_for_user.yml b/investigations/get_logon_rights_modifications_for_user.yml index 5fcf3325d2..10d81579af 100644 --- a/investigations/get_logon_rights_modifications_for_user.yml +++ b/investigations/get_logon_rights_modifications_for_user.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-02-27' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search allows you to retrieve any modifications to logon rights for a specific user account. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ diff --git a/investigations/get_notable_history.yml b/investigations/get_notable_history.yml index 01a9d592f6..0263940a86 100644 --- a/investigations/get_notable_history.yml +++ b/investigations/get_notable_history.yml @@ -4,6 +4,7 @@ version: 2 date: '2017-09-20' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. diff --git a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml b/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml index ff887cae70..eb30eaa867 100644 --- a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml +++ b/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-14' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: 'This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`.' diff --git a/investigations/get_parent_process_info.yml b/investigations/get_parent_process_info.yml index 0d909b9d3e..54a97aea2b 100644 --- a/investigations/get_parent_process_info.yml +++ b/investigations/get_parent_process_info.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-02-28' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest diff --git a/investigations/get_process_file_activity.yml b/investigations/get_process_file_activity.yml index a1acf702dd..04450db005 100644 --- a/investigations/get_process_file_activity.yml +++ b/investigations/get_process_file_activity.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-11-06' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search returns the file activity for a specific process on a specific endpoint search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as diff --git a/investigations/get_process_info.yml b/investigations/get_process_info.yml index 7dfe4d72ec..c5e6c10d84 100644 --- a/investigations/get_process_info.yml +++ b/investigations/get_process_info.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. diff --git a/investigations/get_process_information_for_port_activity.yml b/investigations/get_process_information_for_port_activity.yml index 95b0e406a4..de14541ff3 100644 --- a/investigations/get_process_information_for_port_activity.yml +++ b/investigations/get_process_information_for_port_activity.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as diff --git a/investigations/get_process_responsible_for_the_dns_traffic.yml b/investigations/get_process_responsible_for_the_dns_traffic.yml index 1ffd93df83..09b50690c7 100644 --- a/investigations/get_process_responsible_for_the_dns_traffic.yml +++ b/investigations/get_process_responsible_for_the_dns_traffic.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible diff --git a/investigations/get_sysmon_wmi_activity_for_host.yml b/investigations/get_sysmon_wmi_activity_for_host.yml index 61e769e8b9..e066466664 100644 --- a/investigations/get_sysmon_wmi_activity_for_host.yml +++ b/investigations/get_sysmon_wmi_activity_for_host.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-10-23' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search queries Sysmon WMI events for the host of interest. search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter' diff --git a/investigations/get_web_session_information_via_session_id.yml b/investigations/get_web_session_information_via_session_id.yml index 86854006a5..955b678802 100644 --- a/investigations/get_web_session_information_via_session_id.yml +++ b/investigations/get_web_session_information_via_session_id.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-10-08' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP diff --git a/investigations/investigate_aws_activities_via_region_name.yml b/investigations/investigate_aws_activities_via_region_name.yml index 0eaf244531..d1f8bd0bbb 100644 --- a/investigations/investigate_aws_activities_via_region_name.yml +++ b/investigations/investigate_aws_activities_via_region_name.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user diff --git a/investigations/investigate_aws_user_activities_by_user_field.yml b/investigations/investigate_aws_user_activities_by_user_field.yml index ad753be950..84f4231bcd 100644 --- a/investigations/investigate_aws_user_activities_by_user_field.yml +++ b/investigations/investigate_aws_user_activities_by_user_field.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity diff --git a/investigations/investigate_failed_logins_for_multiple_destinations.yml b/investigations/investigate_failed_logins_for_multiple_destinations.yml index 6047c78962..929d971fd4 100644 --- a/investigations/investigate_failed_logins_for_multiple_destinations.yml +++ b/investigations/investigate_failed_logins_for_multiple_destinations.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search returns failed logins to multiple destinations by user. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) diff --git a/investigations/investigate_network_traffic_from_src_ip.yml b/investigations/investigate_network_traffic_from_src_ip.yml index 560f4f52e3..ba7875b78f 100644 --- a/investigations/investigate_network_traffic_from_src_ip.yml +++ b/investigations/investigate_network_traffic_from_src_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-15' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search allows you to find all the network traffic from a specific IP address. search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' diff --git a/investigations/investigate_okta_activity_by_app.yml b/investigations/investigate_okta_activity_by_app.yml index 875e9467c5..9c9111a9aa 100644 --- a/investigations/investigate_okta_activity_by_app.yml +++ b/investigations/investigate_okta_activity_by_app.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns all okta events associated with a specific app search: '`okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_okta_activity_by_ip_address.yml b/investigations/investigate_okta_activity_by_ip_address.yml index 07b5763759..a3a945fed5 100644 --- a/investigations/investigate_okta_activity_by_ip_address.yml +++ b/investigations/investigate_okta_activity_by_ip_address.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns all okta events from a specific IP address. search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_pass_the_hash_attempts.yml b/investigations/investigate_pass_the_hash_attempts.yml index 58dd9550af..e4a495f05f 100644 --- a/investigations/investigate_pass_the_hash_attempts.yml +++ b/investigations/investigate_pass_the_hash_attempts.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search hunts for dumped NTLM hashes used for pass the hash. search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate | stats count earliest(_time) as first_login latest(_time) as last_login by src_user diff --git a/investigations/investigate_pass_the_ticket_attempts.yml b/investigations/investigate_pass_the_ticket_attempts.yml index 6fe8ef1f33..3e971419a5 100644 --- a/investigations/investigate_pass_the_ticket_attempts.yml +++ b/investigations/investigate_pass_the_ticket_attempts.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search hunts for dumped kerberos ticket from LSASS memory. search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) diff --git a/investigations/investigate_previous_unseen_user.yml b/investigations/investigate_previous_unseen_user.yml index 861bd4b1e4..1e70b07b01 100644 --- a/investigations/investigate_previous_unseen_user.yml +++ b/investigations/investigate_previous_unseen_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search returns previous unseen user, which didn't log in for 30 days. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login diff --git a/investigations/investigate_successful_remote_desktop_authentications.yml b/investigations/investigate_successful_remote_desktop_authentications.yml index f763bc9c43..b5c02044c6 100644 --- a/investigations/investigate_successful_remote_desktop_authentications.yml +++ b/investigations/investigate_successful_remote_desktop_authentications.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation +status: deprecated description: This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. diff --git a/investigations/investigate_suspicious_strings_in_http_header.yml b/investigations/investigate_suspicious_strings_in_http_header.yml index 9dffaedc6b..d2d83857e1 100644 --- a/investigations/investigate_suspicious_strings_in_http_header.yml +++ b/investigations/investigate_suspicious_strings_in_http_header.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-10-20' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by diff --git a/investigations/investigate_user_activities_in_okta.yml b/investigations/investigate_user_activities_in_okta.yml index 5e0af3da3d..522e019822 100644 --- a/investigations/investigate_user_activities_in_okta.yml +++ b/investigations/investigate_user_activities_in_okta.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns all okta events by a specific user search: '`okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_web_posts_from_src.yml b/investigations/investigate_web_posts_from_src.yml index 267c3fdb22..4e331f13bc 100644 --- a/investigations/investigate_web_posts_from_src.yml +++ b/investigations/investigate_web_posts_from_src.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation +status: deprecated description: This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. diff --git a/lookups/security_services_lookup.csv b/lookups/security_services_lookup.csv index b8982c6109..8aa2e35080 100644 --- a/lookups/security_services_lookup.csv +++ b/lookups/security_services_lookup.csv @@ -3,3 +3,8 @@ service,description,category *wscsvc*,Windows Security Center Service,security *windefend*,Windows Defender Service,security *sysmon*,Sysmon Driver,security +*csc_iseagent*,Cisco Secure Client - ISE Posture Agent,security +*csc_nvmagent*,Cisco Secure Client - Network Visibility Agent,security +*csc_umbrellaagent*,Cisco Secure Client - Umbrella Agent,security +*csc_swgagent*,Cisco Secure Client - Umbrella SWG Agent,security +*CiscoAMP*,Cisco Secure Endpoint,security diff --git a/macros/process_cscript.yml b/macros/process_cscript.yml new file mode 100644 index 0000000000..ea60a34a73 --- /dev/null +++ b/macros/process_cscript.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=cscript.exe OR Processes.original_file_name=cscript.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_cscript diff --git a/macros/process_net.yml b/macros/process_net.yml index ca8bb9efa5..8ca4fcec5c 100644 --- a/macros/process_net.yml +++ b/macros/process_net.yml @@ -1,3 +1,3 @@ -definition: (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe") +definition: (Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe") description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_net \ No newline at end of file diff --git a/macros/process_office_products.yml b/macros/process_office_products.yml new file mode 100644 index 0000000000..7462194e06 --- /dev/null +++ b/macros/process_office_products.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") OR Processes.original_file_name IN ("EQNEDT32.EXE", "Excel.exe", "Graph.exe", "MSACCESS.EXE", "MSPUB.EXE", "OneNote.exe", "OneNoteIm.exe", "OneNoteM.exe", "OUTLOOK.EXE", "POWERPNT.EXE", "VISIO.EXE", "WinProj.exe", "WinWord.exe")) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_office_products diff --git a/macros/process_office_products_parent.yml b/macros/process_office_products_parent.yml new file mode 100644 index 0000000000..c4cd308613 --- /dev/null +++ b/macros/process_office_products_parent.yml @@ -0,0 +1,3 @@ +definition: (Processes.parent_process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe")) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_office_products_parent \ No newline at end of file diff --git a/macros/process_powershell.yml b/macros/process_powershell.yml index e90bfb853e..f5b56bebd7 100644 --- a/macros/process_powershell.yml +++ b/macros/process_powershell.yml @@ -1,3 +1,3 @@ -definition: (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE) +definition: (Processes.process_name=pwsh.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE) description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_powershell \ No newline at end of file diff --git a/macros/process_regedit.yml b/macros/process_regedit.yml new file mode 100644 index 0000000000..c611ec65d8 --- /dev/null +++ b/macros/process_regedit.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=regedit.exe OR Processes.original_file_name=REGEDIT.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_regedit diff --git a/macros/process_sc.yml b/macros/process_sc.yml new file mode 100644 index 0000000000..c98f5c4685 --- /dev/null +++ b/macros/process_sc.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name="sc.exe" OR Processes.original_file_name="sc.exe") +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_sc \ No newline at end of file diff --git a/macros/process_wscript.yml b/macros/process_wscript.yml new file mode 100644 index 0000000000..2ec5d68963 --- /dev/null +++ b/macros/process_wscript.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=wscript.exe OR Processes.original_file_name=wscript.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_wscript diff --git a/macros/system_network_configuration_discovery_tools.yml b/macros/system_network_configuration_discovery_tools.yml index 3f869e3af2..245c383f2d 100644 --- a/macros/system_network_configuration_discovery_tools.yml +++ b/macros/system_network_configuration_discovery_tools.yml @@ -1,12 +1,3 @@ -definition: (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" - OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" - OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= - "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= - "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= - "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= - "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= - "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR - process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe") -description: This macro is a list of process that can be used to discover the network - configuration +definition: (process_name="arp.exe" OR process_name="dsquery.exe" OR process_name="hostname.exe" OR process_name="ipconfig.exe" OR process_name="nbstat.exe" OR process_name="net.exe" OR process_name="netsh.exe" OR process_name="nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name="qwinsta.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe") +description: This macro is a list of processes that can be used to discover the network configuration name: system_network_configuration_discovery_tools diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png new file mode 100644 index 0000000000..60ac032a60 Binary files /dev/null and b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png differ diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json new file mode 100644 index 0000000000..24bb6ab01d --- /dev/null +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json @@ -0,0 +1,752 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Identifier Reputation Analysis", + "coa": { + "data": { + "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", + "edges": [ + { + "id": "port_0_to_port_2", + "sourceNode": "0", + "sourcePort": "0_out", + "targetNode": "2", + "targetPort": "2_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_2_to_port_3", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "3", + "targetPort": "3_in" + }, + { + "conditions": [ + { + "index": 1 + } + ], + "id": "port_2_to_port_4", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "4", + "targetPort": "4_in" + }, + { + "conditions": [ + { + "index": 2 + } + ], + "id": "port_2_to_port_5", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "5", + "targetPort": "5_in" + }, + { + "id": "port_3_to_port_6", + "sourceNode": "3", + "sourcePort": "3_out", + "targetNode": "6", + "targetPort": "6_in" + }, + { + "id": "port_4_to_port_10", + "sourceNode": "4", + "sourcePort": "4_out", + "targetNode": "10", + "targetPort": "10_in" + }, + { + "id": "port_5_to_port_13", + "sourceNode": "5", + "sourcePort": "5_out", + "targetNode": "13", + "targetPort": "13_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_6_to_port_17", + "sourceNode": "6", + "sourcePort": "6_out", + "targetNode": "17", + "targetPort": "17_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_10_to_port_16", + "sourceNode": "10", + "sourcePort": "10_out", + "targetNode": "16", + "targetPort": "16_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_13_to_port_18", + "sourceNode": "13", + "sourcePort": "13_out", + "targetNode": "18", + "targetPort": "18_in" + }, + { + "id": "port_17_to_port_26", + "sourceNode": "17", + "sourcePort": "17_out", + "targetNode": "26", + "targetPort": "26_in" + }, + { + "id": "port_26_to_port_1", + "sourceNode": "26", + "sourcePort": "26_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_16_to_port_27", + "sourceNode": "16", + "sourcePort": "16_out", + "targetNode": "27", + "targetPort": "27_in" + }, + { + "id": "port_27_to_port_1", + "sourceNode": "27", + "sourcePort": "27_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_18_to_port_28", + "sourceNode": "18", + "sourcePort": "18_out", + "targetNode": "28", + "targetPort": "28_in" + }, + { + "id": "port_28_to_port_1", + "sourceNode": "28", + "sourcePort": "28_out", + "targetNode": "1", + "targetPort": "1_in" + } + ], + "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", + "nodes": { + "0": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_start", + "id": "0", + "type": "start" + }, + "errors": {}, + "id": "0", + "type": "start", + "warnings": {}, + "x": 1000, + "y": 419.9999999999985 + }, + "1": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_finish", + "id": "1", + "type": "end" + }, + "errors": {}, + "id": "1", + "type": "end", + "warnings": {}, + "x": 1000, + "y": 1520 + }, + "10": { + "data": { + "advanced": { + "customName": "domain reputation filter", + "customNameId": 0, + "description": "Exclude failing domain reputations", + "join": [], + "note": "Exclude failing domain reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "domain_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 3, + "functionName": "domain_reputation_filter", + "id": "10", + "type": "filter" + }, + "errors": {}, + "id": "10", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 840 + }, + "13": { + "data": { + "advanced": { + "customName": "ip reputation filter", + "customNameId": 0, + "description": "Exclude failing ip reputations", + "join": [], + "note": "Exclude failing ip reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "ip_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 4, + "functionName": "ip_reputation_filter", + "id": "13", + "type": "filter" + }, + "errors": {}, + "id": "13", + "type": "filter", + "warnings": {}, + "x": 1380, + "y": 840 + }, + "16": { + "customCode": null, + "data": { + "advanced": { + "customName": "format 2", + "customNameId": 0, + "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", + "join": [], + "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." + }, + "functionId": 4, + "functionName": "format_2", + "id": "16", + "parameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "16", + "type": "format", + "userCode": null, + "warnings": {}, + "x": 980, + "y": 1160 + }, + "17": { + "data": { + "advanced": { + "customName": "format 1", + "customNameId": 0, + "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", + "join": [], + "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." + }, + "functionId": 5, + "functionName": "format_1", + "id": "17", + "parameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "17", + "type": "format", + "warnings": {}, + "x": 640, + "y": 1160 + }, + "18": { + "data": { + "advanced": { + "customName": "format 3", + "customNameId": 0, + "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", + "join": [], + "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " + }, + "functionId": 6, + "functionName": "format_3", + "id": "18", + "parameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "18", + "type": "format", + "warnings": {}, + "x": 1320, + "y": 1160 + }, + "2": { + "data": { + "advanced": { + "customName": "input filter", + "customNameId": 0, + "description": "Filter to pass in a url, domain or ip to it's appropriate action", + "join": [], + "note": "Filter to pass in a url, domain or ip to it's appropriate action" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "!=", + "param": "playbook_input:url", + "value": "" + } + ], + "conditionIndex": 0, + "customName": "url", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 1, + "op": "!=", + "param": "playbook_input:domain", + "value": "" + } + ], + "conditionIndex": 1, + "customName": "domain", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 2, + "op": "!=", + "param": "playbook_input:ip", + "value": "" + } + ], + "conditionIndex": 2, + "customName": "ip", + "logic": "and" + } + ], + "functionId": 1, + "functionName": "input_filter", + "id": "2", + "type": "filter" + }, + "errors": {}, + "id": "2", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 564.5 + }, + "26": { + "customCode": null, + "data": { + "advanced": { + "customName": "build url output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 1, + "functionName": "build_url_output", + "id": "26", + "inputParameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "26", + "type": "code", + "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 640, + "y": 1380 + }, + "27": { + "customCode": null, + "data": { + "advanced": { + "customName": "build domain output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 2, + "functionName": "build_domain_output", + "id": "27", + "inputParameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "27", + "type": "code", + "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 980, + "y": 1380 + }, + "28": { + "customCode": null, + "data": { + "advanced": { + "customName": "build ip output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 3, + "functionName": "build_ip_output", + "id": "28", + "inputParameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "28", + "type": "code", + "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 1320, + "y": 1380 + }, + "3": { + "data": { + "action": "url reputation", + "actionType": "investigate", + "advanced": { + "customName": "url reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an url", + "join": [], + "note": "Use Talos to get threat data on an url" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "url_reputation", + "id": "3", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "url": "filtered-data:input_filter:condition_1:playbook_input:url" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "url" + } + ], + "type": "action" + }, + "errors": {}, + "id": "3", + "type": "action", + "warnings": {}, + "x": 640, + "y": 700 + }, + "4": { + "data": { + "action": "domain reputation", + "actionType": "investigate", + "advanced": { + "customName": "domain reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on a domain", + "join": [], + "note": "Use Talos to get threat data on a domain" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "domain_reputation", + "id": "4", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "domain" + } + ], + "type": "action" + }, + "errors": {}, + "id": "4", + "type": "action", + "warnings": {}, + "x": 980, + "y": 700 + }, + "5": { + "data": { + "action": "ip reputation", + "actionType": "investigate", + "advanced": { + "customName": "ip reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an ip", + "join": [], + "note": "Use Talos to get threat data on an ip" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "ip_reputation", + "id": "5", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "ip" + } + ], + "type": "action" + }, + "errors": {}, + "id": "5", + "type": "action", + "warnings": {}, + "x": 1320, + "y": 700 + }, + "6": { + "data": { + "advanced": { + "customName": "url reputation filter", + "customNameId": 0, + "description": "Exclude failing url reputations", + "join": [], + "note": "Exclude failing url reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "url_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 2, + "functionName": "url_reputation_filter", + "id": "6", + "type": "filter" + }, + "errors": {}, + "id": "6", + "type": "filter", + "warnings": {}, + "x": 700, + "y": 840 + } + }, + "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" + }, + "input_spec": [ + { + "contains": [ + "url" + ], + "description": "A URL provided for reputation analysis", + "name": "url" + }, + { + "contains": [ + "domain" + ], + "description": "A Domain provided for reputation analysis", + "name": "domain" + }, + { + "contains": [ + "ip" + ], + "description": "An IP provided for reputation analysis", + "name": "ip" + } + ], + "output_spec": [ + { + "contains": [], + "datapaths": [ + "build_url_output:custom_function:observable_array", + "build_domain_output:custom_function:observable_array", + "build_ip_output:custom_function:observable_array" + ], + "deduplicate": false, + "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", + "metadata": {}, + "name": "observable" + }, + { + "contains": [], + "datapaths": [ + "format_1:formatted_data", + "format_2:formatted_data", + "format_3:formatted_data" + ], + "deduplicate": false, + "description": "An array of reports. One report per observable type.", + "metadata": {}, + "name": "markdown_report" + } + ], + "playbook_trigger": "artifact_created", + "playbook_type": "data", + "python_version": "3", + "schema": "5.0.15", + "version": "6.3.1.176" + }, + "create_time": "2024-12-11T22:12:36.759275+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [ + "reputation", + "url", + "ip", + "domain", + "Cisco Talos Intelligence" + ] +} diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py new file mode 100644 index 0000000000..83aa27dd3e --- /dev/null +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py @@ -0,0 +1,596 @@ +""" +Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note. +""" + + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta + + +@phantom.playbook_block() +def on_start(container): + phantom.debug('on_start() called') + + # call 'input_filter' block + input_filter(container=container) + + return + +@phantom.playbook_block() +def input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("input_filter() called") + + ################################################################################ + # Filter to pass in a url, domain or ip to it's appropriate action + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["playbook_input:url", "!=", ""] + ], + name="input_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + url_reputation(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids and results for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + conditions=[ + ["playbook_input:domain", "!=", ""] + ], + name="input_filter:condition_2", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + domain_reputation(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + # collect filtered artifact ids and results for 'if' condition 3 + matched_artifacts_3, matched_results_3 = phantom.condition( + container=container, + conditions=[ + ["playbook_input:ip", "!=", ""] + ], + name="input_filter:condition_3", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_3 or matched_results_3: + ip_reputation(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_3, filtered_results=matched_results_3) + + return + + +@phantom.playbook_block() +def url_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("url_reputation() called") + + # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + ################################################################################ + # Use Talos to get threat data on an url + ################################################################################ + + filtered_input_0_url = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_1:playbook_input:url"]) + + parameters = [] + + # build parameters list for 'url_reputation' call + for filtered_input_0_url_item in filtered_input_0_url: + if filtered_input_0_url_item[0] is not None: + parameters.append({ + "url": filtered_input_0_url_item[0], + }) + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.act("url reputation", parameters=parameters, name="url_reputation", assets=["cisco_talos_intelligence"], callback=url_reputation_filter) + + return + + +@phantom.playbook_block() +def domain_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("domain_reputation() called") + + # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + ################################################################################ + # Use Talos to get threat data on a domain + ################################################################################ + + filtered_input_0_domain = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_2:playbook_input:domain"]) + + parameters = [] + + # build parameters list for 'domain_reputation' call + for filtered_input_0_domain_item in filtered_input_0_domain: + if filtered_input_0_domain_item[0] is not None: + parameters.append({ + "domain": filtered_input_0_domain_item[0], + }) + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.act("domain reputation", parameters=parameters, name="domain_reputation", assets=["cisco_talos_intelligence"], callback=domain_reputation_filter) + + return + + +@phantom.playbook_block() +def ip_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("ip_reputation() called") + + # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + ################################################################################ + # Use Talos to get threat data on an ip + ################################################################################ + + filtered_input_0_ip = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_3:playbook_input:ip"]) + + parameters = [] + + # build parameters list for 'ip_reputation' call + for filtered_input_0_ip_item in filtered_input_0_ip: + if filtered_input_0_ip_item[0] is not None: + parameters.append({ + "ip": filtered_input_0_ip_item[0], + }) + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.act("ip reputation", parameters=parameters, name="ip_reputation", assets=["cisco_talos_intelligence"], callback=ip_reputation_filter) + + return + + +@phantom.playbook_block() +def url_reputation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("url_reputation_filter() called") + + ################################################################################ + # Exclude failing url reputations + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["url_reputation:action_result.status", "==", "success"] + ], + name="url_reputation_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + format_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def domain_reputation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("domain_reputation_filter() called") + + ################################################################################ + # Exclude failing domain reputations + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["domain_reputation:action_result.status", "==", "success"] + ], + name="domain_reputation_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + format_2(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def ip_reputation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("ip_reputation_filter() called") + + ################################################################################ + # Exclude failing ip reputations + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["ip_reputation:action_result.status", "==", "success"] + ], + name="ip_reputation_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + format_3(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def format_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("format_2() called") + + ################################################################################ + # Format output of domain threat data into an appropriate format for build_domain_output + # that generates observable objects. + ################################################################################ + + template = """SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%""" + + # parameter list for template variable replacement + parameters = [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ] + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.format(container=container, template=template, parameters=parameters, name="format_2") + + build_domain_output(container=container) + + return + + +@phantom.playbook_block() +def format_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("format_1() called") + + ################################################################################ + # Format output of url threat data into an appropriate format for build_url_output + # that generates observable objects. + ################################################################################ + + template = """SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%""" + + # parameter list for template variable replacement + parameters = [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ] + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.format(container=container, template=template, parameters=parameters, name="format_1") + + build_url_output(container=container) + + return + + +@phantom.playbook_block() +def format_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("format_3() called") + + ################################################################################ + # Format output of ip threat data into an appropriate format for build_ip_output + # that generates observable objects. + ################################################################################ + + template = """SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%""" + + # parameter list for template variable replacement + parameters = [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ] + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.format(container=container, template=template, parameters=parameters, name="format_3") + + build_ip_output(container=container) + + return + + +@phantom.playbook_block() +def build_url_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("build_url_output() called") + + ################################################################################ + # Generate an observable dictionary to output into the observables data path. + ################################################################################ + + filtered_result_0_data_url_reputation_filter = phantom.collect2(container=container, datapath=["filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable","filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level","filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories","filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP"]) + + filtered_result_0_data___observable = [item[0] for item in filtered_result_0_data_url_reputation_filter] + filtered_result_0_data___threat_level = [item[1] for item in filtered_result_0_data_url_reputation_filter] + filtered_result_0_data___threat_categories = [item[2] for item in filtered_result_0_data_url_reputation_filter] + filtered_result_0_data___aup = [item[3] for item in filtered_result_0_data_url_reputation_filter] + + build_url_output__observable_array = None + + ################################################################################ + ## Custom Code Start + ################################################################################ + + from urllib.parse import urlparse + build_url_output__observable_array = [] + + talos_to_score_mapping = {"unknown": "Unknown", "trusted": "Safe", "favorable": "Probably_Safe", "neutral": "May_not_be_Safe", "questionable": "Suspicious_or_Risky", "unstrusted": "Malicious"} + score_table = { + "Unkown": "0", + "Very_Safe": "1", + "Safe": "2", + "Probably_Safe": "3", + "Leans_Safe": "4", + "May_not_be_Safe": "5", + "Exercise_Caution": "6", + "Suspicious_or_Risky": "7", + "Possibly_Malicious": "8", + "Probably_Malicious": "9", + "Malicious": "10" + } + + for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup): + parsed_url = urlparse(url) + score = talos_to_score_mapping.get(threat_level.lower(), "") + observable_object = { + "value": url, + "type": "url", + "reputation": { + "threat_level": threat_level, + "threat_categories": threat_categories, + "aup_categories": aup, + "score": score, + "score_id": score_table.get(score, "") + }, + "attributes": { + "hostname": parsed_url.hostname, + "scheme": parsed_url.scheme + }, + "source": "Cisco Talos Intelligence", + } + if parsed_url.path: + observable_object['attributes']['path'] = parsed_url.path + if parsed_url.query: + observable_object['attributes']['query'] = parsed_url.query + if parsed_url.port: + observable_object['attributes']['port'] = parsed_url.port + + build_url_output__observable_array.append(observable_object) + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_run_data(key="build_url_output:observable_array", value=json.dumps(build_url_output__observable_array)) + + return + + +@phantom.playbook_block() +def build_domain_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("build_domain_output() called") + + ################################################################################ + # Generate an observable dictionary to output into the observables data path. + ################################################################################ + + filtered_result_0_data_domain_reputation_filter = phantom.collect2(container=container, datapath=["filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable","filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level","filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories","filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP"]) + + filtered_result_0_data___observable = [item[0] for item in filtered_result_0_data_domain_reputation_filter] + filtered_result_0_data___threat_level = [item[1] for item in filtered_result_0_data_domain_reputation_filter] + filtered_result_0_data___threat_categories = [item[2] for item in filtered_result_0_data_domain_reputation_filter] + filtered_result_0_data___aup = [item[3] for item in filtered_result_0_data_domain_reputation_filter] + + build_domain_output__observable_array = None + + ################################################################################ + ## Custom Code Start + ################################################################################ + + build_domain_output__observable_array = [] + + talos_to_score_mapping = {"unknown": "Unknown", "trusted": "Safe", "favorable": "Probably_Safe", "neutral": "May_not_be_Safe", "questionable": "Suspicious_or_Risky", "unstrusted": "Malicious"} + score_table = { + "Unkown": "0", + "Very_Safe": "1", + "Safe": "2", + "Probably_Safe": "3", + "Leans_Safe": "4", + "May_not_be_Safe": "5", + "Exercise_Caution": "6", + "Suspicious_or_Risky": "7", + "Possibly_Malicious": "8", + "Probably_Malicious": "9", + "Malicious": "10" + } + + for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup): + score = talos_to_score_mapping.get(threat_level.lower(), "") + observable_object = { + "value": domain, + "type": "domain", + "reputation": { + "threat_level": threat_level, + "threat_categories": threat_categories, + "aup_categories": aup, + "score": score, + "score_id": score_table.get(score, "") + }, + "source": "Cisco Talos Intelligence" + } + build_domain_output__observable_array.append(observable_object) + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_run_data(key="build_domain_output:observable_array", value=json.dumps(build_domain_output__observable_array)) + + return + + +@phantom.playbook_block() +def build_ip_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("build_ip_output() called") + + ################################################################################ + # Generate an observable dictionary to output into the observables data path. + ################################################################################ + + filtered_result_0_data_ip_reputation_filter = phantom.collect2(container=container, datapath=["filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable","filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level","filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories","filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP"]) + + filtered_result_0_data___observable = [item[0] for item in filtered_result_0_data_ip_reputation_filter] + filtered_result_0_data___threat_level = [item[1] for item in filtered_result_0_data_ip_reputation_filter] + filtered_result_0_data___threat_categories = [item[2] for item in filtered_result_0_data_ip_reputation_filter] + filtered_result_0_data___aup = [item[3] for item in filtered_result_0_data_ip_reputation_filter] + + build_ip_output__observable_array = None + + ################################################################################ + ## Custom Code Start + ################################################################################ + + import ipaddress + build_ip_output__observable_array = [] + + talos_to_score_mapping = {"unknown": "Unknown", "trusted": "Safe", "favorable": "Probably_Safe", "neutral": "May_not_be_Safe", "questionable": "Suspicious_or_Risky", "unstrusted": "Malicious"} + score_table = { + "Unkown": "0", + "Very_Safe": "1", + "Safe": "2", + "Probably_Safe": "3", + "Leans_Safe": "4", + "May_not_be_Safe": "5", + "Exercise_Caution": "6", + "Suspicious_or_Risky": "7", + "Possibly_Malicious": "8", + "Probably_Malicious": "9", + "Malicious": "10" + } + + for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup): + score = talos_to_score_mapping.get(threat_level.lower(), "") + observable_object = { + "value": ip, + "type": "ipv4", + "reputation": { + "threat_level": threat_level, + "threat_categories": threat_categories, + "aup_categories": aup, + "score": score, + "score_id": score_table.get(score, "") + }, + "source": "Cisco Talos Intelligence" + } + ip_addr = ipaddress.ip_address(ip) + if isinstance(ip_addr, ipaddress.IPv6Address): + observable_object["type"] = "ipv6" + + build_ip_output__observable_array.append(observable_object) + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_run_data(key="build_ip_output:observable_array", value=json.dumps(build_ip_output__observable_array)) + + return + + +@phantom.playbook_block() +def on_finish(container, summary): + phantom.debug("on_finish() called") + + format_1 = phantom.get_format_data(name="format_1") + format_2 = phantom.get_format_data(name="format_2") + format_3 = phantom.get_format_data(name="format_3") + build_url_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_url_output:observable_array")) != "" else "null") # pylint: disable=used-before-assignment + build_domain_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_domain_output:observable_array")) != "" else "null") # pylint: disable=used-before-assignment + build_ip_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_ip_output:observable_array")) != "" else "null") # pylint: disable=used-before-assignment + + observable_combined_value = phantom.concatenate(build_url_output__observable_array, build_domain_output__observable_array, build_ip_output__observable_array) + markdown_report_combined_value = phantom.concatenate(format_1, format_2, format_3) + + output = { + "observable": observable_combined_value, + "markdown_report": markdown_report_combined_value, + } + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_playbook_output_data(output=output) + + return \ No newline at end of file diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml new file mode 100644 index 0000000000..a66cd2fd49 --- /dev/null +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml @@ -0,0 +1,29 @@ +name: Cisco Talos Intelligence Identifier Reputation Analysis +id: 9cea2ec7-9e6c-4861-b828-336410cdc1cc +version: 1 +date: '2025-01-17' +author: Kelby Shelton, Tapish Jain, Splunk +type: Investigation +description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." +playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis +how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured and a Splunk SOAR cloud license. +references: + - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ +app_list: + - Cisco Talos Intelligence +tags: + defend_technique_id: + - D3-IRA + platform_tags: + - reputation + - url + - ip + - domain + - Cisco Talos Intelligence + playbook_type: Input + vpe_type: Modern + playbook_fields: [] + product: + - Splunk SOAR + use_cases: + - Enrichment diff --git a/playbooks/risk_notable_import_data.json b/playbooks/risk_notable_import_data.json index b88c0b461a..12f59821d9 100644 --- a/playbooks/risk_notable_import_data.json +++ b/playbooks/risk_notable_import_data.json @@ -136,7 +136,7 @@ "errors": {}, "id": "1", "type": "end", - "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occured during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", + "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occured during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", "x": 960, "y": 1800 }, diff --git a/stories/3cx_supply_chain_attack.yml b/stories/3cx_supply_chain_attack.yml index ad37e5a890..6829373141 100644 --- a/stories/3cx_supply_chain_attack.yml +++ b/stories/3cx_supply_chain_attack.yml @@ -3,6 +3,7 @@ id: c4d7618c-73a7-4f7c-8071-060c36850785 version: 1 date: '2023-03-30' author: Michael Haag, Splunk +status: production description: 'On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp, a softphone application from 3CX. The malicious activity includes beaconing to actor controlled infrastructure, deployment of second stage payloads, and, in a small number of cases, hands on keyboard activity. (CrowdStrike)' narrative: 'On March 22, 2023, cybersecurity firm SentinelOne observed a surge in behavioral detections of trojanized 3CXDesktopApp installers, a popular PABX voice and video conferencing software. The multi-stage attack chain, which automatically quarantines trojanized installers, involves downloading ICO files with base64 data from GitHub and eventually leads to a 3rd stage infostealer DLL that is still under analysis. While the Mac installer remains unconfirmed as trojanized, ongoing investigations are also examining other potentially compromised applications, such as Chrome extensions. The threat actor behind the supply chain compromise, which started in February 2022, has used a code signing certificate to sign the trojanized binaries, but connections to existing threat clusters remain unclear. SentinelOne updated their IOCs on March 30th, 2023, with contributions from the research community and continues to monitor the situation for further developments. 3CX identified the vulnerability in the recent versions 18.12.407 and 18.12.416 for the desktop app. A new certificate for the app will also be produced.' references: diff --git a/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml b/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml index 36115ecb93..47f4cfcb1d 100644 --- a/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml +++ b/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml @@ -3,6 +3,7 @@ id: 7589023b-3d98-42b3-ab1c-bb498e68fc2d version: 1 date: '2024-01-08' author: 'Matthew Moore, Patrick Bareiss, Splunk' +status: production description: Kubernetes, a complex container orchestration system, is susceptible to a variety of security threats. This story delves into the different strategies and methods adversaries employ to exploit Kubernetes environments. These include attacks on the control plane, exploitation of misconfigurations, and breaches of containerized applications. diff --git a/stories/acidpour.yml b/stories/acidpour.yml index 20b851e1fc..e93759b339 100644 --- a/stories/acidpour.yml +++ b/stories/acidpour.yml @@ -3,6 +3,7 @@ id: 5992d9b3-f83c-48e8-8164-6cf8f19cfb42 version: 1 date: '2024-04-01' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to AcidPour Wiper malware. AcidPour is a destructive variant designed to irreversibly delete data from targeted systems, rendering them inoperable. Unlike ransomware, AcidPour focuses on data destruction, targeting critical storage sectors and overwriting files to make recovery impossible. diff --git a/stories/acidrain.yml b/stories/acidrain.yml index c63f91d3ff..f2cfd73737 100644 --- a/stories/acidrain.yml +++ b/stories/acidrain.yml @@ -3,6 +3,7 @@ id: c68717c6-4938-434b-987c-e1ce9d516124 version: 1 date: '2022-04-12' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the acidrain malware including deleting of files and etc. AcidRain is an ELF MIPS malware specifically designed to wipe modems and routers. diff --git a/stories/active_directory_discovery.yml b/stories/active_directory_discovery.yml index 23067fde96..85afaed8cb 100644 --- a/stories/active_directory_discovery.yml +++ b/stories/active_directory_discovery.yml @@ -3,6 +3,7 @@ id: 8460679c-2b21-463e-b381-b813417c32f2 version: 1 date: '2021-08-20' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments. narrative: 'Discovery consists of techniques an adversay uses to gain knowledge about diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml index ed03bd160f..224548cb64 100644 --- a/stories/active_directory_kerberos_attacks.yml +++ b/stories/active_directory_kerberos_attacks.yml @@ -3,6 +3,7 @@ id: 38b8cf16-8461-11ec-ade1-acde48001122 version: 1 date: '2022-02-02' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments. narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access diff --git a/stories/active_directory_lateral_movement.yml b/stories/active_directory_lateral_movement.yml index 9c31419c16..9b7139c117 100644 --- a/stories/active_directory_lateral_movement.yml +++ b/stories/active_directory_lateral_movement.yml @@ -3,6 +3,7 @@ id: 399d65dc-1f08-499b-a259-aad9051f38ad version: 3 date: '2021-12-09' author: David Dorsey, Mauricio Velazco Splunk +status: production description: Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml index 673f255263..a2c49e1736 100644 --- a/stories/active_directory_password_spraying.yml +++ b/stories/active_directory_password_spraying.yml @@ -3,6 +3,7 @@ id: 3de109da-97d2-11eb-8b6a-acde48001122 version: 2 date: '2021-04-07' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. narrative: 'In a password spraying attack, adversaries leverage one or a small list diff --git a/stories/active_directory_privilege_escalation.yml b/stories/active_directory_privilege_escalation.yml index dc396f9dfb..4b7671cb52 100644 --- a/stories/active_directory_privilege_escalation.yml +++ b/stories/active_directory_privilege_escalation.yml @@ -3,6 +3,7 @@ id: fa34a5d8-df0a-404c-8237-11f99cba1d5f version: 1 date: '2023-03-20' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Privilege Escalation attacks within Active Directory environments. narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. diff --git a/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml b/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml index e38731c89a..c359973e9b 100644 --- a/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml +++ b/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml @@ -3,6 +3,7 @@ id: e33e2e38-f9c2-432d-8be6-bc67b92aa82e version: 1 date: '2023-08-23' author: Michael Haag, Splunk +status: production description: In July 2023, a significant vulnerability, CVE-2023-29298, affecting Adobe ColdFusion was uncovered by Rapid7, shedding light on an access control bypass mechanism. This vulnerability allows attackers to access sensitive ColdFusion Administrator endpoints by exploiting a flaw in the URL path validation. Disturbingly, this flaw can be chained with another critical vulnerability, CVE-2023-26360, which has been actively exploited. The latter enables unauthorized arbitrary code execution and file reading. Adobe has promptly addressed these vulnerabilities, but the intricacies and potential ramifications of their combination underscore the importance of immediate action by organizations. With active exploitation in the wild and the ability to bypass established security measures, the situation is alarming. Organizations are urged to apply the updates provided by Adobe immediately, considering the active threat landscape and the severe implications of these chained vulnerabilities. narrative: Adobe ColdFusion, a prominent application server, has been thrust into the cybersecurity spotlight due to two intertwined vulnerabilities. The first, CVE-2023-29298, identified by Rapid7 in July 2023, pertains to an access control bypass in ColdFusion's security mechanisms. This flaw allows attackers to access protected ColdFusion Administrator endpoints simply by manipulating the URL path, specifically by inserting an additional forward slash. Compounding the threat is the revelation that CVE-2023-29298 can be chained with CVE-2023-26360, another severe ColdFusion vulnerability. This latter vulnerability, which has seen active exploitation, permits unauthorized attackers to execute arbitrary code or read arbitrary files on the affected system. In practice, an attacker could exploit the access control bypass to access sensitive ColdFusion endpoints and subsequently exploit the arbitrary code execution vulnerability, broadening their control and access over the targeted system. diff --git a/stories/agenttesla.yml b/stories/agenttesla.yml index 6145f9da10..aff5c845de 100644 --- a/stories/agenttesla.yml +++ b/stories/agenttesla.yml @@ -3,6 +3,7 @@ id: 9bb6077a-843e-418b-b134-c57ef997103c version: 1 date: '2022-04-12' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the AgentTesla malware including .chm application child process, ftp/smtp connection, persistence and many more. AgentTesla is one of the advanced remote access trojans (RAT) that are capable of stealing sensitive information from the infected or targeted host machine. diff --git a/stories/amadey.yml b/stories/amadey.yml index 91f19a726e..8bcbf47ade 100644 --- a/stories/amadey.yml +++ b/stories/amadey.yml @@ -3,6 +3,7 @@ id: a919a01b-3ea5-4ed4-9cbe-11cd8b64c36c version: 1 date: '2023-06-16' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains searches that aims to detect activities related to Amadey, a type of malware that primarily operates as a banking Trojan. It is designed to steal sensitive information such as login credentials, credit card details, and other financial data from infected systems. The malware typically targets Windows-based computers. narrative: Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. The primary function is to steal information and further distribute malware. It aims to extract a variety of information from infected devices and attempts to evade the detection of security measures by reducing the volume of data exfiltration compared to that seen in other malicious instances. references: diff --git a/stories/apache_struts_vulnerability.yml b/stories/apache_struts_vulnerability.yml index 083cca22b5..46fb9a302b 100644 --- a/stories/apache_struts_vulnerability.yml +++ b/stories/apache_struts_vulnerability.yml @@ -3,6 +3,7 @@ id: 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e version: 1 date: '2018-12-06' author: Rico Valdez, Splunk +status: production description: Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. diff --git a/stories/apt29_diplomatic_deceptions_with_wineloader.yml b/stories/apt29_diplomatic_deceptions_with_wineloader.yml index 43f164b3aa..28acf92824 100644 --- a/stories/apt29_diplomatic_deceptions_with_wineloader.yml +++ b/stories/apt29_diplomatic_deceptions_with_wineloader.yml @@ -3,6 +3,7 @@ id: 7cb5fdb5-4c36-4721-8b0a-4cc5e78afadd version: 1 date: '2024-03-26' author: Michael Haag, splunk +status: production description: APT29, a sophisticated threat actor linked to the Russian SVR, has expanded its cyber espionage activities to target European diplomats and German political parties. Utilizing a novel backdoor variant, WINELOADER, these campaigns leverage diplomatic-themed lures to initiate infection chains, demonstrating APT29's evolving tactics and interest in geopolitical intelligence. The operations, marked by their low volume and high precision, underscore the broad threat APT29 poses to Western political and diplomatic entities. narrative: APT29, also known as Cozy Bear, has historically focused on espionage activities aligned with Russian intelligence interests. In recent campaigns, APT29 has notably shifted its operational focus, targeting not only its traditional diplomatic missions but also expanding into the political domain, specifically German political parties. These campaigns have been characterized by the deployment of WINELOADER, a sophisticated backdoor that facilitates the exfiltration of sensitive information. The use of themed lures, such as invitations from the Ambassador of India and CDU-themed documents, highlights APT29's strategic use of social engineering to compromise targets. The operations against European diplomats and German political entities reveal APT29's adaptive tactics and its persistent effort to gather intelligence that could influence Russia's geopolitical strategy. The precision of these attacks, coupled with the use of compromised websites for command and control, underscores the evolving threat landscape and the need for heightened cybersecurity vigilance among potential targets. references: diff --git a/stories/asset_tracking.yml b/stories/asset_tracking.yml index cd2afdb44d..1c343caf6e 100644 --- a/stories/asset_tracking.yml +++ b/stories/asset_tracking.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce77 version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk +status: production description: Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. diff --git a/stories/asyncrat.yml b/stories/asyncrat.yml index fbac0d1313..0b3b0efd4b 100644 --- a/stories/asyncrat.yml +++ b/stories/asyncrat.yml @@ -3,6 +3,7 @@ id: d7053072-7dd2-4874-8314-bfcbc99978a4 version: 1 date: '2023-01-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the AsyncRAT malware including mshta application child process, bat loader execution, persistence and many more. AsyncRAT is an open source remote administration tool released last 2019. It's designed to remotely control computers via an encrypted diff --git a/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml index e73cbfbb06..8f99a94428 100644 --- a/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml +++ b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml @@ -3,6 +3,7 @@ id: 91623a50-41fa-4c4e-8637-c239b80ff439 version: 1 date: '2022-06-03' author: Michael Haag, Splunk +status: production description: On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release. narrative: Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk. diff --git a/stories/awfulshred.yml b/stories/awfulshred.yml index e9f962a6c9..697fa00da4 100644 --- a/stories/awfulshred.yml +++ b/stories/awfulshred.yml @@ -3,6 +3,7 @@ id: e36935ce-f48c-4fb2-8109-7e80c1cdc9e2 version: 1 date: '2023-01-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the AwfulShred malware including wiping files, process kill, system reboot via system request, shred, and service stops. narrative: AwfulShred is a malicious linux shell script designed to corrupt or wipe the linux targeted system. diff --git a/stories/aws_cross_account_activity.yml b/stories/aws_cross_account_activity.yml index 1f8e8e899c..0198363273 100644 --- a/stories/aws_cross_account_activity.yml +++ b/stories/aws_cross_account_activity.yml @@ -3,6 +3,7 @@ id: 2f2f610a-d64d-48c2-b57c-967a2b49ab5a version: 1 date: '2018-06-04' author: David Dorsey, Splunk +status: production description: Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. diff --git a/stories/aws_defense_evasion.yml b/stories/aws_defense_evasion.yml index fdf8802ed2..0bb3ca6bb9 100644 --- a/stories/aws_defense_evasion.yml +++ b/stories/aws_defense_evasion.yml @@ -3,6 +3,7 @@ id: 4e00b690-293f-434d-a9d8-bcfb2ea5fff9 version: 1 date: '2022-07-15' author: Gowthamaraj Rajendran, Splunk +status: production description: Identify activity and techniques associated with the Evasion of Defenses within AWS, such as Disabling CloudTrail, Deleting CloudTrail and many others. narrative: Adversaries employ a variety of techniques in order to avoid detection and operate diff --git a/stories/aws_iam_privilege_escalation.yml b/stories/aws_iam_privilege_escalation.yml index 6d08eaa713..cd93765bff 100644 --- a/stories/aws_iam_privilege_escalation.yml +++ b/stories/aws_iam_privilege_escalation.yml @@ -3,6 +3,7 @@ id: ced74200-8465-4bc3-bd2c-22782eec6750 version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk +status: production description: This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation. narrative: 'Amazon Web Services provides a neat feature called Identity and Access diff --git a/stories/aws_identity_and_access_management_account_takeover.yml b/stories/aws_identity_and_access_management_account_takeover.yml index 350970df73..83d01652aa 100644 --- a/stories/aws_identity_and_access_management_account_takeover.yml +++ b/stories/aws_identity_and_access_management_account_takeover.yml @@ -3,6 +3,7 @@ id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9 version: 2 date: '2022-08-19' author: Gowthamaraj Rajendran, Bhavin Patel, Splunk +status: production description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS. narrative: Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities. diff --git a/stories/aws_network_acl_activity.yml b/stories/aws_network_acl_activity.yml index 7def55a8b2..9f4e6c038e 100644 --- a/stories/aws_network_acl_activity.yml +++ b/stories/aws_network_acl_activity.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50ff268af4 version: 2 date: '2018-05-21' author: Bhavin Patel, Splunk +status: production description: Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative: AWS CloudTrail is an AWS service that helps you enable governance, compliance, diff --git a/stories/aws_security_hub_alerts.yml b/stories/aws_security_hub_alerts.yml index c0745fdcef..6b5b2f5799 100644 --- a/stories/aws_security_hub_alerts.yml +++ b/stories/aws_security_hub_alerts.yml @@ -3,6 +3,7 @@ id: 2f2f610a-d64d-48c2-b57c-96722b49ab5a version: 1 date: '2020-08-04' author: Bhavin Patel, Splunk +status: production description: This story is focused around detecting Security Hub alerts generated from AWS narrative: AWS Security Hub collects and consolidates findings from AWS security services diff --git a/stories/aws_user_monitoring.yml b/stories/aws_user_monitoring.yml index a4b80bd9a9..111d64b824 100644 --- a/stories/aws_user_monitoring.yml +++ b/stories/aws_user_monitoring.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f1269af3 version: 1 date: '2018-03-12' author: Bhavin Patel, Splunk +status: production description: Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. diff --git a/stories/azorult.yml b/stories/azorult.yml index 6f6c5e5315..13dc30714f 100644 --- a/stories/azorult.yml +++ b/stories/azorult.yml @@ -3,6 +3,7 @@ id: efed5343-4ac2-42b1-a16d-da2428d0ce94 version: 1 date: '2022-06-09' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. diff --git a/stories/azure_active_directory_account_takeover.yml b/stories/azure_active_directory_account_takeover.yml index 709898c01e..9a145d303e 100644 --- a/stories/azure_active_directory_account_takeover.yml +++ b/stories/azure_active_directory_account_takeover.yml @@ -3,6 +3,7 @@ id: 41514c46-7118-4eab-a9bb-f3bfa4e3bea9 version: 2 date: '2022-07-14' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Account Takeover attacks against Azure Active Directory tenants. narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.' diff --git a/stories/azure_active_directory_persistence.yml b/stories/azure_active_directory_persistence.yml index 6f6bc34c18..101da0107f 100644 --- a/stories/azure_active_directory_persistence.yml +++ b/stories/azure_active_directory_persistence.yml @@ -3,6 +3,7 @@ id: dca983db-6334-4a0d-be32-80611ca1396c version: 2 date: '2024-09-24' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants. narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure diff --git a/stories/azure_active_directory_privilege_escalation.yml b/stories/azure_active_directory_privilege_escalation.yml index b379373393..ea48106a1d 100644 --- a/stories/azure_active_directory_privilege_escalation.yml +++ b/stories/azure_active_directory_privilege_escalation.yml @@ -3,6 +3,7 @@ id: ec78e872-b79c-417d-b256-8fde902522fb version: 1 date: '2023-04-24' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Privilege Escalation attacks within Azure Active Directory tenants. narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. diff --git a/stories/backdoor_pingpong.yml b/stories/backdoor_pingpong.yml new file mode 100644 index 0000000000..bdcb1e61ac --- /dev/null +++ b/stories/backdoor_pingpong.yml @@ -0,0 +1,18 @@ +name: Backdoor Pingpong +id: 1231ff23-543e-4eb9-b9e0-a97d9333bebc +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Backdoor.PingPong malware, a legacy threat that provides unauthorized remote access to compromised systems. Look for signs such as unexpected pings or ICMP traffic patterns that deviate from normal behavior. Investigate unauthorized processes or network connections, particularly those attempting to establish external communication. Combining threat intelligence with behavioral analytics helps identify this backdoor’s attempts to exploit vulnerabilities. Early detection and response are critical to mitigating the risk of this malware. +narrative: Backdoor.PingPong is an older malware family designed to provide unauthorized remote access to compromised systems. It often utilizes ICMP traffic, including ping requests, as a covert communication channel to receive commands or exfiltrate data. Despite its simplicity compared to modern threats, it can still be effective in environments with inadequate monitoring. By exploiting system vulnerabilities or poor network segmentation, PingPong enables attackers to maintain persistence and control. Detecting its activity requires careful analysis of network traffic and unusual process behaviors. +references: +- https://www.crowdstrike.com/en-us/blog/an-analysis-of-lightbasin-telecommunications-attacks/ +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/baron_samedit_cve_2021_3156.yml b/stories/baron_samedit_cve_2021_3156.yml index 2253b438a9..3030bc82b8 100644 --- a/stories/baron_samedit_cve_2021_3156.yml +++ b/stories/baron_samedit_cve_2021_3156.yml @@ -3,6 +3,7 @@ id: 817b0dfc-23ba-4bcc-96cc-2cb77e428fbe version: 1 date: '2021-01-27' author: Shannon Davis, Splunk +status: production description: Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and diff --git a/stories/bishopfox_sliver_adversary_emulation_framework.yml b/stories/bishopfox_sliver_adversary_emulation_framework.yml index 555690d779..80229fc439 100644 --- a/stories/bishopfox_sliver_adversary_emulation_framework.yml +++ b/stories/bishopfox_sliver_adversary_emulation_framework.yml @@ -3,6 +3,7 @@ id: 8c2e2cba-3fd8-424f-a890-5080bdaf3f31 version: 1 date: '2023-01-24' author: Michael Haag, Splunk +status: production description: The following analytic story providers visibility into the latest adversary TTPs in regard to the use of Sliver. Sliver has gained more traction with adversaries as it is often seen as an alternative to Cobalt Strike. It is designed to be scalable and can be used by organizations of all sizes to perform security testing. Sliver is highly modular and contains an Extension package manager (armory) allowing easy install (automatic compilation) of various 3rd party tools such as BOFs and .NET tooling like Ghostpack (Rubeus, Seatbelt, SharpUp, Certify, and so forth) (CyberReason,2023). narrative: Sliver is an open source cross-platform adversary emulation/red team framework produced by BishopFox. references: diff --git a/stories/bits_jobs.yml b/stories/bits_jobs.yml index c37db375b3..ccd05ebe37 100644 --- a/stories/bits_jobs.yml +++ b/stories/bits_jobs.yml @@ -3,6 +3,7 @@ id: dbc7edce-8e4c-11eb-9f31-acde48001122 version: 1 date: '2021-03-26' author: Michael Haag, Splunk +status: production description: Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. narrative: Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, diff --git a/stories/blackbyte_ransomware.yml b/stories/blackbyte_ransomware.yml index d9b5bab660..f74d3ff9c9 100644 --- a/stories/blackbyte_ransomware.yml +++ b/stories/blackbyte_ransomware.yml @@ -3,6 +3,7 @@ id: b18259ac-0746-45d7-bd1f-81d65274a80b version: 1 date: '2023-07-10' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackByte ransomware, including looking for file writes associated with BlackByte, persistence, initial access, account registry diff --git a/stories/blacklotus_campaign.yml b/stories/blacklotus_campaign.yml index e111004c34..c1e9c19a7a 100644 --- a/stories/blacklotus_campaign.yml +++ b/stories/blacklotus_campaign.yml @@ -3,6 +3,7 @@ id: 8eb0e418-a2b6-4327-a387-85c976662c8f version: 1 date: '2023-04-14' author: Michael Haag, Splunk +status: production description: The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality narrative: "The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn't gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature UEFI Secure Boot is now a reality. present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022. (ESET, 2023) The following content aims to aid defenders in detecting suspicious bootloaders and understanding the diverse techniques employed in this campaign." diff --git a/stories/blackmatter_ransomware.yml b/stories/blackmatter_ransomware.yml index 3d24e928bb..8be2860351 100644 --- a/stories/blackmatter_ransomware.yml +++ b/stories/blackmatter_ransomware.yml @@ -3,6 +3,7 @@ id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee version: 1 date: '2021-09-06' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackMatter ransomware, including looking for file writes associated with BlackMatter, force safe mode boot, autadminlogon account registry diff --git a/stories/blacksuit_ransomware.yml b/stories/blacksuit_ransomware.yml index 836f605316..3f262c2c5e 100644 --- a/stories/blacksuit_ransomware.yml +++ b/stories/blacksuit_ransomware.yml @@ -3,6 +3,7 @@ id: 4c7bef12-679f-433c-92dd-d9feccc1432b version: 1 date: '2024-08-26' author: Michael Haag, Splunk +status: production description: This analytic story covers the tactics, techniques, and procedures (TTPs) associated with BlackSuit ransomware, as observed in a December 2023 intrusion. The story encompasses the full attack lifecycle, from initial access via Cobalt Strike beacons to lateral movement, credential access, and ultimately the deployment of BlackSuit ransomware. It aims to help security teams detect and respond to similar attacks by focusing on key behaviors such as Cobalt Strike activity, use of tools like ADFind and Sharphound, and the final ransomware deployment phase. narrative: In December 2023, a sophisticated intrusion culminating in the deployment of BlackSuit ransomware was observed. The attack began with the execution of a Cobalt Strike beacon, which initially communicated through CloudFlare to conceal the true C2 server. The threat actors leveraged various tools throughout the intrusion, including Sharphound, Rubeus, SystemBC, and ADFind, alongside built-in Windows utilities. diff --git a/stories/brand_monitoring.yml b/stories/brand_monitoring.yml index 221c2686c3..a6689bb9c8 100644 --- a/stories/brand_monitoring.yml +++ b/stories/brand_monitoring.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce78 version: 1 date: '2017-12-19' author: David Dorsey, Splunk +status: production description: Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml index e87f78166e..49ad3f50c9 100644 --- a/stories/braodo_stealer.yml +++ b/stories/braodo_stealer.yml @@ -3,6 +3,7 @@ id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24 version: 1 date: '2024-10-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware. references: diff --git a/stories/brute_ratel_c4.yml b/stories/brute_ratel_c4.yml index 53e0e14fec..02eaee9672 100644 --- a/stories/brute_ratel_c4.yml +++ b/stories/brute_ratel_c4.yml @@ -3,6 +3,7 @@ id: 0ec9dbfe-f64e-46bb-8eb8-04e92326f513 version: 1 date: '2022-08-23' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, diff --git a/stories/caddy_wiper.yml b/stories/caddy_wiper.yml index 5606c2b246..cd9472011a 100644 --- a/stories/caddy_wiper.yml +++ b/stories/caddy_wiper.yml @@ -3,6 +3,7 @@ id: 435a156a-8ef1-4184-bd52-22328fb65d3a version: 1 date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions. references: diff --git a/stories/chaos_ransomware.yml b/stories/chaos_ransomware.yml index 5107153c54..651fc9d296 100644 --- a/stories/chaos_ransomware.yml +++ b/stories/chaos_ransomware.yml @@ -3,6 +3,7 @@ id: 153d7b8f-27f2-4e4d-bae8-dfafd93a22a8 version: 1 date: '2023-01-11' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Chaos ransomware, including looking for file writes (file encryption and ransomware notes), deleting shadow volume storage, registry key modification, dropping of files in startup folder, and more. diff --git a/stories/cisa_aa22_257a.yml b/stories/cisa_aa22_257a.yml index 4a73333fa0..0433f4fc47 100644 --- a/stories/cisa_aa22_257a.yml +++ b/stories/cisa_aa22_257a.yml @@ -3,6 +3,7 @@ id: e1aec96e-bc7d-4edf-8ff7-3da9b7b29147 version: 1 date: '2022-09-15' author: Michael Haag, Splunk +status: production description: The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations. narrative: This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC. Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations. diff --git a/stories/cisa_aa22_264a.yml b/stories/cisa_aa22_264a.yml index 26000c1c0b..fd98ccbb63 100644 --- a/stories/cisa_aa22_264a.yml +++ b/stories/cisa_aa22_264a.yml @@ -3,6 +3,7 @@ id: bc7056a5-c3b0-4b83-93ce-5f31739305c8 version: 1 date: '2022-09-22' author: Michael Haag, Splunk +status: production description: Iranian State Actors Conduct Cyber Operations Against the Government of Albania. narrative: The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory to provide information on recent cyber operations against the Government of Albania in July and September. This advisory provides a timeline of activity observed, from initial access to execution of encryption and wiper attacks. Additional information concerning files used by the actors during their exploitation of and cyber attack against the victim organization is provided in Appendices A and B. In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran. diff --git a/stories/cisa_aa22_277a.yml b/stories/cisa_aa22_277a.yml index 8e1a97b986..a1fcb81711 100644 --- a/stories/cisa_aa22_277a.yml +++ b/stories/cisa_aa22_277a.yml @@ -3,6 +3,7 @@ id: db408f93-e915-4215-9962-5fada348bdd7 version: 1 date: '2022-10-05' author: Michael Haag, Splunk +status: production description: From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization's enterprise network. During incident response activities, multiple utilities were utilized. narrative: CISA uncovered that likely multiple APT groups compromised the organization's network, and some APT actors had long-term access to the environment. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim's sensitive data. references: diff --git a/stories/cisa_aa22_320a.yml b/stories/cisa_aa22_320a.yml index c8b9b560f2..c20685b733 100644 --- a/stories/cisa_aa22_320a.yml +++ b/stories/cisa_aa22_320a.yml @@ -3,6 +3,7 @@ id: c1fca73d-3a8d-49a6-b9c0-1d5d155f7dd4 version: 1 date: '2022-11-16' author: Michael Haag, Splunk +status: production description: CISA and the FBI have identified an APT activity where the adversary gained initial access via Log4Shell via a unpatched VMware Horizon server. From there the adversary moved laterally and continued to its objective. narrative: From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence. CISA and the Federal Bureau of Investigation (FBI) assess that the FCEB network was compromised by Iranian government-sponsored APT actors. references: diff --git a/stories/cisa_aa23_347a.yml b/stories/cisa_aa23_347a.yml index b792b6a09a..f685852f97 100644 --- a/stories/cisa_aa23_347a.yml +++ b/stories/cisa_aa23_347a.yml @@ -3,6 +3,7 @@ id: 257a2f28-fcbe-4226-8d1f-957880098331 version: 3 date: '2024-12-09' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might be related to the SVR cyber activity tactics and techniques. While SVR followed a similar playbook in each compromise, they also adjusted to each operating environment and not all presented steps or actions below were executed on every host. diff --git a/stories/cisa_aa24_241a.yml b/stories/cisa_aa24_241a.yml index 1a7eba2bdf..3c36288c56 100644 --- a/stories/cisa_aa24_241a.yml +++ b/stories/cisa_aa24_241a.yml @@ -3,6 +3,7 @@ id: f075adb6-76a6-4476-b24a-ce9d471a1bdc version: 2 date: '2024-10-07' author: Michael Haag, Splunk +status: production description: This story covers the tactics of Iran-based cyber actors exploiting U.S. and foreign organizations across multiple sectors, as detailed in CISA Alert AA24-241A. It focuses on their methods of gaining initial access, establishing persistence, and enabling ransomware attacks through vulnerabilities in public-facing networking devices. narrative: As of August 2024, Iran-based cyber actors continue to exploit organizations across several U.S. sectors and other countries. The FBI assesses that a significant percentage of these operations aim to obtain network access for collaboration with ransomware affiliates. The actors typically use Shodan to identify vulnerable devices, then exploit public-facing networking equipment such as Citrix Netscaler, F5 BIG-IP, and various VPNs. They deploy webshells, create local accounts, and manipulate existing ones to maintain access. Post-exploitation, they repurpose credentials, disable security software, and use remote access tools. The group collaborates with ransomware affiliates like NoEscape, Ransomhouse, and ALPHV, actively participating in network lockdowns and extortion strategies. Defenders should prioritize patching public-facing devices, monitoring for unauthorized accounts and suspicious PowerShell activity, implementing strong access controls, and regularly reviewing logs for signs of compromise. references: diff --git a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml index 2590025e80..a2aa3217ce 100644 --- a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml +++ b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml @@ -3,6 +3,7 @@ id: b5394b6a-b774-4bb6-a2bc-98f98cf7be88 version: 1 date: '2023-10-17' author: Michael Haag, Splunk +status: production description: Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity. narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username cisco_tac_admin from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name cisco_support from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (cisco_service.conf). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed. references: diff --git a/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml b/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml index 1f8b980b90..54310ad57b 100644 --- a/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml +++ b/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml @@ -3,6 +3,7 @@ id: b194d644-4095-431a-bee0-a8e6ec067414 version: 1 date: '2023-10-24' author: Michael Haag, Splunk +status: production description: A critical security update, CVE-2023-4966, has been released for NetScaler ADC and NetScaler Gateway. This vulnerability, discovered by our internal team, can result in unauthorized data disclosure if exploited. Reports of incidents consistent with session hijacking have been received. The Cybersecurity and Infrastructure Security Agency (CISA) has added an entry for CVE-2023-4966 to its Known Exploited and Vulnerabilities Catalog. No workarounds are available for this vulnerability, and immediate installation of the recommended builds is strongly advised. narrative: On October 10, 2023, Cloud Software Group released builds to fix CVE-2023-4966, a vulnerability affecting NetScaler ADC and NetScaler Gateway. This vulnerability, if exploited, can lead to unauthorized data disclosure and possibly session hijacking. Although there were no known exploits at the time of disclosure, we have since received credible reports of targeted attacks exploiting this vulnerability. The Cybersecurity and Infrastructure Security Agency (CISA) has added an entry for CVE-2023-4966 to its Known Exploited and Vulnerabilities Catalog, which contains detection and mitigation guidance for observed exploitations of CVE-2023-4966 by threat actors against NetScaler ADC and NetScaler Gateway. We strongly recommend that users of affected builds immediately install the recommended builds, as this vulnerability has been identified as critical. No workarounds are available for this vulnerability. references: diff --git a/stories/citrix_netscaler_adc_cve_2023_3519.yml b/stories/citrix_netscaler_adc_cve_2023_3519.yml index 67f648a756..40bcb23015 100644 --- a/stories/citrix_netscaler_adc_cve_2023_3519.yml +++ b/stories/citrix_netscaler_adc_cve_2023_3519.yml @@ -3,6 +3,7 @@ id: 094df1fe-4345-4c01-8a0f-c65cf7b758bd version: 1 date: '2023-07-20' author: Michael Haag, Splunk +status: production description: The CVE-2023-3519 vulnerability in NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway has been exploited by threat actors, as detailed in a recent advisory. The unauthenticated remote code execution vulnerability was utilized as a zero-day to establish a webshell on a non-production environment NetScaler ADC appliance within a critical infrastructure organization. This facilitated the execution of discovery on the victim's active directory and the collection and exfiltration of data. The advisory offers a comprehensive examination of the threat actors' tactics, techniques, and procedures (TTPs), alongside recommended detection methods and incident response guidelines. Immediate patch application from Citrix and the use of the detection guidance in the advisory is strongly recommended for critical infrastructure organizations to mitigate system compromises. narrative: Recent advisories have highlighted the exploitation of CVE-2023-3519, a critical vulnerability in Citrix's NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors utilized this vulnerability to implant a webshell on a NetScaler ADC appliance within a critical infrastructure organization's non-production environment. This action granted them the ability to perform active directory discovery, data collection, and exfiltration. Notably, attempts for lateral movement to a domain controller were obstructed by network-segmentation controls. diff --git a/stories/citrix_sharefile_rce_cve_2023_24489.yml b/stories/citrix_sharefile_rce_cve_2023_24489.yml index 7ae133eb88..b6e0aace42 100644 --- a/stories/citrix_sharefile_rce_cve_2023_24489.yml +++ b/stories/citrix_sharefile_rce_cve_2023_24489.yml @@ -3,6 +3,7 @@ id: 10c7e01a-5743-4995-99df-a66f6b5db653 version: 1 date: '2023-07-26' author: Michael Haag, Splunk +status: production description: A critical vulnerability has been discovered in ShareFile's Storage Zones Controller software (CVE-2023-24489), used by numerous organizations for file sharing and storage. The vulnerability allows unauthenticated arbitrary file upload and remote code execution due to a cryptographic bug in the software's encryption but lack of authentication system. The risk comes from a failing encryption check, allowing potential cybercriminals to upload malicious files to the server. The bug was found in the Documentum Connector's .aspx files. The security risk has a potentially large impact due to the software's wide use and the sensitivity of the stored data. Citrix has released a security update to address this issue. narrative: The ShareFile Storage Zones Controller is a .NET web application running under IIS, which manages the storage of files in ShareFile's system. It was discovered that this software has a critical vulnerability (CVE-2023-24489) in the file upload functionality provided by the Documentum Connector's .aspx files. Specifically, the security flaw lies in the encryption check in the file upload process which could be bypassed, allowing for unauthenticated arbitrary file uploads and remote code execution. diff --git a/stories/cleo_file_transfer_software.yml b/stories/cleo_file_transfer_software.yml index 1a107919a1..56646f3b12 100644 --- a/stories/cleo_file_transfer_software.yml +++ b/stories/cleo_file_transfer_software.yml @@ -3,6 +3,7 @@ id: 058be65c-f007-4a3a-90f6-d2604f98a18b version: 1 date: '2024-12-11' author: Michael Haag, Splunk +status: production description: This analytic story addresses the exploitation of Cleo file transfer software products (LexiCom, VLTrader, and Harmony) through CVE-2024-50623. This vulnerability allows unauthenticated attackers to execute arbitrary system commands through the web interface, potentially leading to remote code execution and system compromise. narrative: In December 2024, threat actors began actively exploiting a critical vulnerability (CVE-2024-50623) in Cleo's file transfer software suite. The vulnerability affects multiple Cleo products including LexiCom, VLTrader, and Harmony. Attackers can exploit this flaw to execute system commands without authentication through the web interface, typically leveraging PowerShell commands for payload delivery and execution. The exploitation often involves accessing the software's autorun functionality and web interface to deploy malicious commands, potentially leading to data theft, ransomware deployment, or establishment of persistent access. Common installation paths include C:\LexiCom, C:\VLTrader, and C:\Harmony, with critical activity logged in their respective XML log files. references: diff --git a/stories/clop_ransomware.yml b/stories/clop_ransomware.yml index f743272a76..aecaa0c4b8 100644 --- a/stories/clop_ransomware.yml +++ b/stories/clop_ransomware.yml @@ -3,6 +3,7 @@ id: 5a6f6849-1a26-4fae-aa05-fa730556eeb6 version: 1 date: '2021-03-17' author: Rod Soto, Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, diff --git a/stories/cloud_cryptomining.yml b/stories/cloud_cryptomining.yml index 201f5dbeb1..bce58d3fc1 100644 --- a/stories/cloud_cryptomining.yml +++ b/stories/cloud_cryptomining.yml @@ -3,6 +3,7 @@ id: 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a version: 1 date: '2019-10-02' author: David Dorsey, Splunk +status: production description: Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users diff --git a/stories/cloud_federated_credential_abuse.yml b/stories/cloud_federated_credential_abuse.yml index 2ecc0ac7a7..46d6fd6d48 100644 --- a/stories/cloud_federated_credential_abuse.yml +++ b/stories/cloud_federated_credential_abuse.yml @@ -3,6 +3,7 @@ id: cecdc1e7-0af2-4a55-8967-b9ea62c0317d version: 1 date: '2021-01-26' author: Rod Soto, Splunk +status: production description: This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml index b890d5f045..41beae52bc 100644 --- a/stories/cobalt_strike.yml +++ b/stories/cobalt_strike.yml @@ -3,6 +3,7 @@ id: bcfd17e8-5461-400a-80a2-3b7d1459220c version: 1 date: '2021-02-16' author: Michael Haag, Splunk +status: production description: Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat diff --git a/stories/coldroot_macos_rat.yml b/stories/coldroot_macos_rat.yml index 22c8722f66..cbda3ac38f 100644 --- a/stories/coldroot_macos_rat.yml +++ b/stories/coldroot_macos_rat.yml @@ -3,6 +3,7 @@ id: bd91a2bc-d20b-4f44-a982-1bea98e86390 version: 1 date: '2019-01-09' author: Jose Hernandez, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, diff --git a/stories/collection_and_staging.yml b/stories/collection_and_staging.yml index 484b6aad63..309340254f 100644 --- a/stories/collection_and_staging.yml +++ b/stories/collection_and_staging.yml @@ -3,6 +3,7 @@ id: 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a version: 2 date: '2024-09-24' author: Rico Valdez, Splunk +status: production description: 'Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating diff --git a/stories/command_and_control.yml b/stories/command_and_control.yml index 4009173f30..c599c62581 100644 --- a/stories/command_and_control.yml +++ b/stories/command_and_control.yml @@ -3,6 +3,7 @@ id: 943773c6-c4de-4f38-89a8-0b92f98804d8 version: 1 date: '2018-06-01' author: Rico Valdez, Splunk +status: production description: Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate Command And Control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions diff --git a/stories/compromised_linux_host.yml b/stories/compromised_linux_host.yml index 7e2902252e..50f6105e26 100644 --- a/stories/compromised_linux_host.yml +++ b/stories/compromised_linux_host.yml @@ -3,6 +3,7 @@ id: d7ea2fc0-3710-4257-b64f-f3c2a6abebd3 version: 1 date: '2024-06-25' author: Teoderick Contreras, Splunk +status: production description: Monitor for activities and techniques associated with Compromised Linux Host attacks. These include unauthorized access attempts, unusual network traffic patterns, and the presence of unknown or suspicious processes. Look for unexpected changes in system files, modifications to configuration files, diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index 76cb25069f..92ed1d5d65 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -3,6 +3,7 @@ id: 19669154-e9d1-4a01-b144-e6592a078092 version: 1 date: '2023-01-19' author: Mauricio Velazco, Bhavin Patel, Splunk +status: production description: Monitor for activities and techniques associated with Compromised User Account attacks. narrative: Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic story groups detections that can help security operations teams identify the potential signs of Compromised User Accounts. references: diff --git a/stories/compromised_windows_host.yml b/stories/compromised_windows_host.yml index a4c8902e42..c8c8989695 100644 --- a/stories/compromised_windows_host.yml +++ b/stories/compromised_windows_host.yml @@ -3,6 +3,7 @@ id: 95c15513-180b-4534-9e34-a085a26ce481 version: 1 date: '2024-04-18' author: Teoderick Contreras, Splunk +status: production description: Monitor for activities and techniques associated with Compromised Windows Host attacks. A compromised Windows host refers to a computer system running the Windows operating system that has been infiltrated or attacked by unauthorized parties. Such compromises often result in security breaches, diff --git a/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml b/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml index b5e9404d20..77f25b44d7 100644 --- a/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml +++ b/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 509387a5-ab53-4656-8bb5-4bc8c2c074d9 version: 1 date: '2024-01-22' author: Michael Haag, Splunk +status: production description: The following analytic story covers use cases for detecting and investigating potential attacks against Confluence Data Center and Confluence Server. narrative: The analytic story of Confluence Data Center and Confluence Server encompasses a comprehensive approach to safeguarding these platforms from a variety of threats. By leveraging the analytics created in the project, security teams are equipped to detect, investigate, and respond to potential attacks that target Confluence environments. references: diff --git a/stories/connectwise_screenconnect_vulnerabilities.yml b/stories/connectwise_screenconnect_vulnerabilities.yml index 624f135c0e..8fcb3d9dbb 100644 --- a/stories/connectwise_screenconnect_vulnerabilities.yml +++ b/stories/connectwise_screenconnect_vulnerabilities.yml @@ -3,6 +3,7 @@ id: fbee3185-748c-40d8-a60c-c2e2c9eb738b version: 1 date: '2024-02-21' author: Michael Haag, Splunk +status: production description: This analytic story provides a comprehensive overview of the ConnectWise ScreenConnect vulnerabilities. narrative: The following analytic story includes content for recently disclosed CWE-288 Authentication Bypass and CWE-22 Path Traversal. The vulnerabilities, identified as critical with CVSS scores of 10 and 9.8, respectively, enable unauthorized users to bypass authentication and perform path traversal attacks on affected ScreenConnect instances. The analytic story includes detection analytics for both vulnerabilities, which are crucial for identifying and responding to active exploitation in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issues, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers. The analytic story also includes guidance on how to implement the detection analytics, known false positives, and references to additional resources for further analysis and remediation. references: diff --git a/stories/credential_dumping.yml b/stories/credential_dumping.yml index 729ac02a98..8778378f00 100644 --- a/stories/credential_dumping.yml +++ b/stories/credential_dumping.yml @@ -3,6 +3,7 @@ id: 854d78bf-d0e2-4f4e-b05c-640905f86d7a version: 3 date: '2020-02-04' author: Rico Valdez, Splunk +status: production description: Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and diff --git a/stories/critical_alerts.yml b/stories/critical_alerts.yml index cbb7bc2d47..ac2c88d6aa 100644 --- a/stories/critical_alerts.yml +++ b/stories/critical_alerts.yml @@ -3,6 +3,7 @@ id: bc7056a5-c2b0-4b83-93ce-5f31739305c8 version: 1 date: '2024-06-21' author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk +status: production description: This analytic story contains detections that monitor critical alerts data from security tools ingested into Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations and other risk events, it offers a nuanced perspective on potential threats and security posture of your organization. narrative: Monitoring alerts from security tools is crucial because they act as an early warning system for potential threats. High and critical alerts signal serious issues that could compromise your systems if not addressed promptly. By keeping an eye on these alerts, you can quickly identify and respond to threats, minimizing damage and protecting sensitive data. This proactive approach not only strengthens your security posture but also ensures you're ready to tackle any compliance requirements by maintaining a detailed record of significant security events. This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively. references: diff --git a/stories/crushftp_vulnerabilities.yml b/stories/crushftp_vulnerabilities.yml index 45231703cc..a72cb1f9d8 100644 --- a/stories/crushftp_vulnerabilities.yml +++ b/stories/crushftp_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 933df821-3b75-4669-a58a-e85d2cd7b9b0 version: 1 date: '2024-05-16' author: Michael Haag, Splunk +status: production description: CVE-2024-4040 identifies a critical server-side template injection vulnerability in all versions of CrushFTP prior to 10.7.1 and 11.1.0, allowing unauthenticated remote attackers to execute arbitrary code, bypass authentication, and access files outside of the VFS Sandbox. narrative: CVE-2024-4040 exposes a severe server-side template injection vulnerability in all versions of CrushFTP prior to 10.7.1 and 11.1.0. This critical flaw allows unauthenticated remote attackers to execute arbitrary code, bypass authentication mechanisms, and access files outside of the VFS Sandbox. The vulnerability was urgently addressed by CrushFTP with a patch after it was actively exploited in the wild, highlighting the necessity for immediate updates to secure server environments. Users operating behind a DMZ are reported to have an additional layer of protection against this exploit. The discovery and subsequent reporting of this vulnerability by Simon Garrelou of Airbus CERT prompted a swift response from CrushFTP, underscoring the critical nature of the flaw and the potential risks associated with delayed patching. This incident serves as a stark reminder of the importance of maintaining up-to-date software to defend against evolving cybersecurity threats. references: diff --git a/stories/crypto_stealer.yml b/stories/crypto_stealer.yml new file mode 100644 index 0000000000..4558db0b3e --- /dev/null +++ b/stories/crypto_stealer.yml @@ -0,0 +1,18 @@ +name: Crypto Stealer +id: 71efef85-aec7-46c7-bdaa-693b9d2bef4b +version: 1 +date: '2024-12-17' +author: Teoderick Contreras, Splunk +status: production +description: Crypto Stealer is a malware strain designed to exfiltrate cryptocurrency-related data from compromised systems. It scans the infected machine for wallet files, clipboard activity, and other cryptocurrency artifacts, focusing on intercepting sensitive information like private keys or transaction details. The malware communicates with a command-and-control (C2) server to transmit the harvested data and can dynamically adapt its behavior based on instructions received. Detection indicators include unusual network activity to suspicious IP addresses, unauthorized file access targeting cryptocurrency wallet directories, and anomalous clipboard usage associated with cryptocurrency strings (e.g., wallet addresses). Security solutions should monitor for these behaviors and implement heuristic analysis to identify deviations from normal system operations. Users are encouraged to maintain updated endpoint protection and avoid downloading files from untrusted sources to mitigate the risk posed by Crypto Stealer. +narrative: In the ever-evolving landscape of cybercrime, Crypto Stealer emerges as a sophisticated malware targeting the lucrative world of cryptocurrency. By exploiting system vulnerabilities, the malware actively scans for wallet files, clipboard data, and other digital assets, focusing on intercepting sensitive information like private keys and transaction details. Once deployed, Crypto Stealer communicates with a command-and-control (C2) server to exfiltrate stolen data and receive updated instructions for further exploitation. Notably, it often works in tandem with other malicious components, such as XMRig, a widely abused cryptocurrency miner that hijacks system resources for illicit mining operations, and ClipBanker, which manipulates clipboard activity to replace wallet addresses in transactions with those controlled by attackers. These combined tactics maximize the attack's profitability while minimizing the victim's ability to detect the theft. Indicators of compromise include unauthorized access to cryptocurrency wallet files, suspicious clipboard behavior, and outbound connections to known malicious IP addresses. By understanding and recognizing these patterns, defenders can develop effective strategies to detect and mitigate threats like Crypto Stealer before significant damage occurs. + +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml index 158f7e59c6..e9ab1a2528 100644 --- a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml +++ b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml @@ -3,6 +3,7 @@ id: 55721831-577e-41be-beef-bdc03c81486a version: 1 date: '2022-10-14' author: Michael Haag, Splunk +status: production description: Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684. narrative: FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai) references: diff --git a/stories/cve_2023_21716_word_rtf_heap_corruption.yml b/stories/cve_2023_21716_word_rtf_heap_corruption.yml index ba28e62bab..03398785ef 100644 --- a/stories/cve_2023_21716_word_rtf_heap_corruption.yml +++ b/stories/cve_2023_21716_word_rtf_heap_corruption.yml @@ -3,6 +3,7 @@ id: b1aeaf2c-8496-42e7-b2f7-15c328bc75d9 version: 1 date: '2023-03-10' author: Michael Haag, Splunk +status: production description: A proof-of-concept for CVE-2023-21716, a critical vulnerability in Microsoft Word that allows remote code execution utilizing a heap corruption in rich text files. narrative: This analytic story covers content that will assist organizations in identifying potential RTF RCE abuse on endpoints. The vulnerability was assigned a 9.8 out of 10 severity score, with Microsoft addressing it in the February Patch Tuesday security updates along with a couple of workarounds. diff --git a/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml b/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml index d26d93f9c5..9b6c3a8db2 100644 --- a/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml +++ b/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml @@ -4,6 +4,7 @@ id: ead8eb10-9e7c-4a07-a44c-c6e73997a1a3 version: 1 date: '2023-10-04' author: Michael Haag, Splunk +status: production description: On October 4, 2023, Atlassian disclosed a critical privilege escalation vulnerability, CVE-2023-22515, affecting on-premises instances of Confluence Server and Confluence Data Center. This flaw might allow external attackers to exploit accessible Confluence instances, creating unauthorized Confluence administrator accounts. Indicators suggest the vulnerability is remotely exploitable. The affected versions range from 8.0.0 to 8.5.1, but versions prior to 8.0.0 and Atlassian Cloud sites are unaffected. Atlassian advises customers to update to a fixed version or implement mitigation strategies. Indicators of compromise (IoCs) and mitigation steps, such as blocking access to /setup/* endpoints, are provided. narrative: Upon Atlassian's disclosure of CVE-2023-22515, there's an immediate need to assess the threat landscape of on-premises Confluence installations. As the vulnerability affects privilege escalation and may be exploited remotely, SIEM solutions should be poised to detect potential threats. diff --git a/stories/cve_2023_23397_outlook_elevation_of_privilege.yml b/stories/cve_2023_23397_outlook_elevation_of_privilege.yml index ff7b827a72..f6b6dd9616 100644 --- a/stories/cve_2023_23397_outlook_elevation_of_privilege.yml +++ b/stories/cve_2023_23397_outlook_elevation_of_privilege.yml @@ -3,6 +3,7 @@ id: b459911b-551f-480f-a402-18cf89ca1e9c version: 1 date: '2023-03-15' author: Michael Haag, Splunk +status: production description: Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. narrative: Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure. CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required. diff --git a/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml b/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml index c8d55e764e..fb78e6bd4c 100644 --- a/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml +++ b/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml @@ -3,6 +3,7 @@ id: dd7fb691-63d6-47ad-9a7f-1b9005cefad2 version: 1 date: '2023-07-11' author: Michael Haag, Splunk +status: production description: CVE-2023-36884 is an unpatched zero-day vulnerability affecting Windows and Microsoft Office products. The vulnerability allows for remote code execution through specially crafted Microsoft Office documents, enabling an attacker to operate in the context of the victim. As of now, there are no security updates available. However, users of Microsoft Defender for Office and the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are safeguarded against this exploit. For other users, temporary mitigation can be achieved by adding specific application names to a designated registry key. narrative: CVE-2023-36884 is a serious security vulnerability that affects a range of Microsoft Office products and Windows systems. It is a zero-day flaw, meaning it was already being exploited before Microsoft became aware of it or had a chance to develop a patch. diff --git a/stories/cyclops_blink.yml b/stories/cyclops_blink.yml index 1572718ccf..f7a0ef5782 100644 --- a/stories/cyclops_blink.yml +++ b/stories/cyclops_blink.yml @@ -3,6 +3,7 @@ id: 7c75b1c8-dfff-46f1-8250-e58df91b6fd9 version: 2 date: '2024-03-14' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the cyclopsblink malware including firewall modification, spawning more process, botnet c2 communication, defense evasion and etc. Cyclops Blink is a Linux ELF executable compiled for 32-bit x86 and PowerPC architecture that has targeted several network devices. diff --git a/stories/darkcrystal_rat.yml b/stories/darkcrystal_rat.yml index fdb6d3bbbb..f2e12cceac 100644 --- a/stories/darkcrystal_rat.yml +++ b/stories/darkcrystal_rat.yml @@ -3,6 +3,7 @@ id: 639e6006-0885-4847-9394-ddc2902629bf version: 1 date: '2022-07-26' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc. The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest diff --git a/stories/darkgate_malware.yml b/stories/darkgate_malware.yml index c5c3119073..b30c1a1d2a 100644 --- a/stories/darkgate_malware.yml +++ b/stories/darkgate_malware.yml @@ -3,6 +3,7 @@ id: a4727b27-9e68-48f0-94a2-253cfb30c15d version: 1 date: '2023-10-31' author: Michael Haag, Splunk +status: production description: Telekom Security CTI has uncovered a new phishing-driven malware campaign distributing DarkGate malware. This campaign utilizes stolen email threads to trick users into downloading malicious payloads via hyperlinks. An initial false link to Emotet stirred the security community, but deeper analysis confirmed its true identity as DarkGate, with characteristics like AutoIt scripts and a known command-and-control protocol. This report by Fabian Marquardt details the intricate infection mechanisms, including MSI and VBS file deliveries, sophisticated evasion techniques, and a robust configuration extraction method surpassing current standards. The single developer behind DarkGate, active on cybercrime forums, has shifted the malware's use from private to a rent-out model, implying an expected rise in its deployment. Researchers have also developed a decryption technique for the DarkGate malware, which aids in static analysis and detection, though it requires careful validation to avoid false positives. narrative: Telekom Security CTi has recently put a spotlight on the proliferation of DarkGate malware via a sophisticated malspam campaign, initially mistaken for the notorious Emotet malware. The campaign smartly manipulates stolen email conversations, embedding hyperlinks that, once clicked, activate a malware download. Fabian Marquardt's analysis traces the infection's footprint, revealing a dual delivery mechanism through MSI and VBS files. These files, cloaked in legitimate wrappers or obscured with junk code, ultimately download the malware via embedded scripts. diff --git a/stories/darkside_ransomware.yml b/stories/darkside_ransomware.yml index 03c56d3d58..98f2265e2e 100644 --- a/stories/darkside_ransomware.yml +++ b/stories/darkside_ransomware.yml @@ -3,6 +3,7 @@ id: 507edc74-13d5-4339-878e-b9114ded1f35 version: 1 date: '2021-05-12' author: Bhavin Patel, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware narrative: This story addresses Darkside ransomware. This ransomware payload has many diff --git a/stories/data_destruction.yml b/stories/data_destruction.yml index 40155991ec..961e2eb739 100644 --- a/stories/data_destruction.yml +++ b/stories/data_destruction.yml @@ -3,6 +3,7 @@ id: 4ae5c0d1-cebd-47d1-bfce-71bf096e38aa version: 1 date: '2023-04-06' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and unrecoverable file encryption. This analytic story may cover several known activities related to malware implants used in geo-political war to wipe disks or files to interrupt the network-wide operation diff --git a/stories/data_exfiltration.yml b/stories/data_exfiltration.yml index 75a4bfe197..b1381ee263 100644 --- a/stories/data_exfiltration.yml +++ b/stories/data_exfiltration.yml @@ -3,6 +3,7 @@ id: 66b0fe0c-1351-11eb-adc1-0242ac120002 version: 2 date: '2023-05-17' author: Bhavin Patel, Shannon Davis, Splunk +status: production description: Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets. narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. diff --git a/stories/data_protection.yml b/stories/data_protection.yml index 1e9d60b76c..c15ea6c7dc 100644 --- a/stories/data_protection.yml +++ b/stories/data_protection.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce33 version: 1 date: '2017-09-14' author: Bhavin Patel, Splunk +status: production description: Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. diff --git a/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml b/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml index 10ab15d858..296d43b462 100644 --- a/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml +++ b/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml @@ -3,6 +3,7 @@ id: 8ccdd852-3878-4871-ae37-e5af5c67baf3 version: 1 date: '2024-12-06' author: Nasreddine Bencherchali, Michael Haag, Splunk +status: production description: This analytic story focuses on detecting potential defense evasion or unauthorized access attempts through tampering with Security Descriptor Definition Language (SDDL) settings. Attackers may modify SDDL configurations to alter permissions on critical system components, such as event logs and services, to obscure their activities or gain unauthorized access. This story includes detections for changes to 'ChannelAccess' and 'CustomSD' registry values, as well as the use of tools like 'sc.exe sdset', 'icacls' and 'subinacl' to modify securable objects (files, registry, services, etc) permissions. narrative: Adversaries may attempt to evade detection or gain unauthorized access by modifying ACLs or Security Descriptors of different securable objects on the Windows operating system. By altering these settings, attackers can grant themselves elevated privileges or suppress logging mechanisms, thereby hindering detection and response efforts. Monitoring changes to critical registry values and the execution of specific tools used for SDDL modifications can help identify such malicious activities. references: diff --git a/stories/deobfuscate_decode_files_or_information.yml b/stories/deobfuscate_decode_files_or_information.yml index 50940436d9..2e93f5198f 100644 --- a/stories/deobfuscate_decode_files_or_information.yml +++ b/stories/deobfuscate_decode_files_or_information.yml @@ -3,6 +3,7 @@ id: 0bd01a54-8cbe-11eb-abcd-acde48001122 version: 1 date: '2021-03-24' author: Michael Haag, Splunk +status: production description: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. narrative: An example of obfuscated files is `Certutil.exe` usage to encode a portable diff --git a/stories/deprecated/aws_cryptomining.yml b/stories/deprecated/aws_cryptomining.yml index 00e67e2d10..abd30eff4d 100644 --- a/stories/deprecated/aws_cryptomining.yml +++ b/stories/deprecated/aws_cryptomining.yml @@ -3,6 +3,7 @@ id: ced74200-8465-4bc3-bd2c-9a782eec6750 version: 1 date: '2018-03-08' author: David Dorsey, Splunk +status: deprecated description: Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are diff --git a/stories/deprecated/aws_suspicious_provisioning_activities.yml b/stories/deprecated/aws_suspicious_provisioning_activities.yml index c71b2a26a5..c5403b49fa 100644 --- a/stories/deprecated/aws_suspicious_provisioning_activities.yml +++ b/stories/deprecated/aws_suspicious_provisioning_activities.yml @@ -3,6 +3,7 @@ id: 3338b567-3804-4261-9889-cf0ca4753c7f version: 1 date: '2018-03-16' author: David Dorsey, Splunk +status: deprecated description: Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. diff --git a/stories/deprecated/common_phishing_frameworks.yml b/stories/deprecated/common_phishing_frameworks.yml index 3e28ef83fb..055ff6b43a 100644 --- a/stories/deprecated/common_phishing_frameworks.yml +++ b/stories/deprecated/common_phishing_frameworks.yml @@ -3,6 +3,7 @@ id: 9a64ab44-9214-4639-8163-7eaa2621bd61 version: 2 date: '2024-09-24' author: Splunk Research Team, Splunk +status: deprecated description: 'Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.' diff --git a/stories/deprecated/container_implantation_monitoring_and_investigation.yml b/stories/deprecated/container_implantation_monitoring_and_investigation.yml index 46ec10568e..53ee1b98a8 100644 --- a/stories/deprecated/container_implantation_monitoring_and_investigation.yml +++ b/stories/deprecated/container_implantation_monitoring_and_investigation.yml @@ -3,6 +3,7 @@ id: aa0e28b1-0521-4b6f-9d2a-7b87e34af246 version: 1 date: '2020-02-20' author: Rod Soto, Rico Valdez, Splunk +status: deprecated description: Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container diff --git a/stories/deprecated/host_redirection.yml b/stories/deprecated/host_redirection.yml index d9a497d2a3..90953fb738 100644 --- a/stories/deprecated/host_redirection.yml +++ b/stories/deprecated/host_redirection.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50fe268af4 version: 1 date: '2017-09-14' author: Rico Valdez, Splunk +status: deprecated description: Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches diff --git a/stories/deprecated/kubernetes_sensitive_role_activity.yml b/stories/deprecated/kubernetes_sensitive_role_activity.yml index 48c1c453f5..735eb620fa 100644 --- a/stories/deprecated/kubernetes_sensitive_role_activity.yml +++ b/stories/deprecated/kubernetes_sensitive_role_activity.yml @@ -3,6 +3,7 @@ id: 8b3984d2-17b6-47e9-ba43-a3376e70fdcc version: 1 date: '2020-05-20' author: Rod Soto, Splunk +status: deprecated description: This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative: Kubernetes is the most used container orchestration platform, this orchestration diff --git a/stories/deprecated/lateral_movement.yml b/stories/deprecated/lateral_movement.yml index f68f02b8b6..20c7ee6a69 100644 --- a/stories/deprecated/lateral_movement.yml +++ b/stories/deprecated/lateral_movement.yml @@ -3,6 +3,7 @@ id: 399d65dc-1f08-499b-a259-abd9051f38ad version: 3 date: '2024-09-24' author: David Dorsey, Splunk +status: deprecated description: "DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts." narrative: "Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation. Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or \"crown jewels\" to a persistent threat actor. An adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders. If there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software." references: diff --git a/stories/deprecated/monitor_backup_solution.yml b/stories/deprecated/monitor_backup_solution.yml index 8a7d64c2e3..c3f2dc7a32 100644 --- a/stories/deprecated/monitor_backup_solution.yml +++ b/stories/deprecated/monitor_backup_solution.yml @@ -3,6 +3,7 @@ id: abe807c7-1eb6-4304-ac32-6e7aacdb891d version: 1 date: '2017-09-12' author: David Dorsey, Splunk +status: deprecated description: Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. diff --git a/stories/deprecated/monitor_for_unauthorized_software.yml b/stories/deprecated/monitor_for_unauthorized_software.yml index 046c60f015..a9e7d9688d 100644 --- a/stories/deprecated/monitor_for_unauthorized_software.yml +++ b/stories/deprecated/monitor_for_unauthorized_software.yml @@ -3,6 +3,7 @@ id: 8892a655-6205-43f7-abba-06460e38c8ae version: 2 date: '2024-09-24' author: David Dorsey, Splunk +status: deprecated description: 'Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.' narrative: 'It is critical to identify unauthorized software and processes running diff --git a/stories/deprecated/office_365_detections.yml b/stories/deprecated/office_365_detections.yml index 139c6cd309..d2fb3d09b7 100644 --- a/stories/deprecated/office_365_detections.yml +++ b/stories/deprecated/office_365_detections.yml @@ -3,6 +3,7 @@ id: 1a51dd71-effc-48b2-abc4-3e9cdb61e5b9 version: 2 date: '2020-12-16' author: Patrick Bareiss, Mauricio Velazco, Splunk +status: deprecated description: Monitor for activities and anomalies indicative of potential threats within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. Given the centralized storage of sensitive organizational data within O365 and its widespread adoption, it has become a focal point for cybersecurity efforts. The platform's complexity, combined with its ubiquity, makes it both a valuable asset and a prime target for potential threats. As O365's importance grows, it increasingly becomes a target for attackers seeking to exploit organizational data and systems. Security teams should prioritize monitoring O365 not just because of the sensitive data it often holds, but also due to the myriad ways the platform can be exploited. Understanding and monitoring O365's security landscape is crucial for organizations to detect, respond to, and mitigate potential threats in a timely manner. references: diff --git a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml b/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml index 47b8207275..3b0bbf9c8d 100644 --- a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml +++ b/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 6d3306f6-bb2b-4219-8609-8efad64032f2 version: 1 date: '2018-01-08' author: David Dorsey, Splunk +status: deprecated description: Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story. narrative: Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that diff --git a/stories/deprecated/suspicious_aws_ec2_activities.yml b/stories/deprecated/suspicious_aws_ec2_activities.yml index ee51137331..89b5348253 100644 --- a/stories/deprecated/suspicious_aws_ec2_activities.yml +++ b/stories/deprecated/suspicious_aws_ec2_activities.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f1268af3 version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk +status: deprecated description: Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users diff --git a/stories/deprecated/unusual_aws_ec2_modifications.yml b/stories/deprecated/unusual_aws_ec2_modifications.yml index 9c4e22c9d9..f0f1fc4b54 100644 --- a/stories/deprecated/unusual_aws_ec2_modifications.yml +++ b/stories/deprecated/unusual_aws_ec2_modifications.yml @@ -3,6 +3,7 @@ id: 73de57ef-0dfc-411f-b1e7-fa24428aeae0 version: 1 date: '2018-04-09' author: David Dorsey, Splunk +status: deprecated description: Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. diff --git a/stories/deprecated/web_fraud_detection.yml b/stories/deprecated/web_fraud_detection.yml index 7aae434b6f..81d8ee3448 100644 --- a/stories/deprecated/web_fraud_detection.yml +++ b/stories/deprecated/web_fraud_detection.yml @@ -3,6 +3,7 @@ id: 18bb45b9-7684-45c6-9e97-1fdd0d98c0a7 version: 1 date: '2018-10-08' author: Jim Apger, Splunk +status: deprecated description: Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative: 'The Federal Bureau of Investigations (FBI) defines Internet fraud as the diff --git a/stories/derusbi.yml b/stories/derusbi.yml new file mode 100644 index 0000000000..7ad346c7d4 --- /dev/null +++ b/stories/derusbi.yml @@ -0,0 +1,20 @@ +name: Derusbi +id: 7cd48610-6f75-4b49-ae1d-3bf2cfff1c1c +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Derusbi malware, a sophisticated threat often linked to advanced persistent attacks. Monitor anomalies in network traffic, file execution patterns, and unauthorized access attempts to uncover potential compromises. Utilize behavioral analytics and endpoint detection tools to identify indicators such as pesistence, service creation, lateral movement via removable drive, driver loading and dll side loading. By correlating these findings with known threat intelligence, you can quickly respond to and mitigate Derusbi-related incidents. +narrative: Derusbi is a stealthy and versatile malware family often associated with advanced persistent threats (APTs) targeting high-value systems. Known for its adaptability, it employs techniques like process injection and encrypted communications to evade detection. This malware family is frequently used for espionage, data theft, and system compromise, leveraging custom modules tailored to specific targets. Derusbi’s ability to remain undetected for extended periods makes it a significant threat, emphasizing the need for robust monitoring and advanced detection mechanisms to mitigate its impact. +references: +- https://www.virusbulletin.com/uploads/pdf/conference_slides/2015/Pun-etal-VB2015.pdf +- https://www.trendmicro.com/en_us/research/21/g/biopass-rat-new-malware-sniffs-victims-via-live-streaming.html +- https://web.archive.org/web/20180310053107/https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/detect_zerologon_attack.yml b/stories/detect_zerologon_attack.yml index 892b2ac0c3..8046a670bc 100644 --- a/stories/detect_zerologon_attack.yml +++ b/stories/detect_zerologon_attack.yml @@ -3,6 +3,7 @@ id: 5d14a962-569e-4578-939f-f386feb63ce4 version: 1 date: '2020-09-18' author: Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk +status: production description: Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now diff --git a/stories/dev_sec_ops.yml b/stories/dev_sec_ops.yml index 6f3ed76978..901e811304 100644 --- a/stories/dev_sec_ops.yml +++ b/stories/dev_sec_ops.yml @@ -3,6 +3,7 @@ id: 0ca8c38e-631e-4b81-940c-f9c5450ce41e version: 1 date: '2021-08-18' author: Patrick Bareiss, Splunk +status: production description: This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor. diff --git a/stories/dhs_report_ta18_074a.yml b/stories/dhs_report_ta18_074a.yml index 2201c5b835..262be24ba6 100644 --- a/stories/dhs_report_ta18_074a.yml +++ b/stories/dhs_report_ta18_074a.yml @@ -3,6 +3,7 @@ id: 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef version: 2 date: '2020-01-22' author: Rico Valdez, Splunk +status: production description: Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. diff --git a/stories/disabling_security_tools.yml b/stories/disabling_security_tools.yml index 53b7e4d996..ae54416e48 100644 --- a/stories/disabling_security_tools.yml +++ b/stories/disabling_security_tools.yml @@ -3,6 +3,7 @@ id: fcc27099-46a0-46b0-a271-5c7dab56b6f1 version: 2 date: '2020-02-04' author: Rico Valdez, Splunk +status: production description: Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. diff --git a/stories/dns_amplification_attacks.yml b/stories/dns_amplification_attacks.yml index f30a899be4..5b0a291c06 100644 --- a/stories/dns_amplification_attacks.yml +++ b/stories/dns_amplification_attacks.yml @@ -3,6 +3,7 @@ id: a563972b-d2e2-4978-b6ca-6e83e24af4d3 version: 1 date: '2016-09-13' author: Bhavin Patel, Splunk +status: production description: DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, diff --git a/stories/dns_hijacking.yml b/stories/dns_hijacking.yml index 618219af3b..2190d33fc1 100644 --- a/stories/dns_hijacking.yml +++ b/stories/dns_hijacking.yml @@ -3,6 +3,7 @@ id: 8169f17b-ef68-4b59-aa28-586907301221 version: 1 date: '2020-02-04' author: Bhavin Patel, Splunk +status: production description: Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative: 'Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), diff --git a/stories/domain_trust_discovery.yml b/stories/domain_trust_discovery.yml index 8bf8f639df..212d1df5ec 100644 --- a/stories/domain_trust_discovery.yml +++ b/stories/domain_trust_discovery.yml @@ -3,6 +3,7 @@ id: e6f30f14-8daf-11eb-a017-acde48001122 version: 1 date: '2021-03-25' author: Michael Haag, Splunk +status: production description: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. diff --git a/stories/double_zero_destructor.yml b/stories/double_zero_destructor.yml index a0d30d0bb3..39a8569f0d 100644 --- a/stories/double_zero_destructor.yml +++ b/stories/double_zero_destructor.yml @@ -3,6 +3,7 @@ id: f56e8c00-3224-4955-9a6e-924ec7da1df7 version: 1 date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD. narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls. references: diff --git a/stories/dynamic_dns.yml b/stories/dynamic_dns.yml index 313c503b7b..526b9f03ce 100644 --- a/stories/dynamic_dns.yml +++ b/stories/dynamic_dns.yml @@ -3,6 +3,7 @@ id: 8169f17b-ef68-4b59-aae8-586907301221 version: 2 date: '2018-09-06' author: Bhavin Patel, Splunk +status: production description: Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. diff --git a/stories/earth_estries.yml b/stories/earth_estries.yml new file mode 100644 index 0000000000..81202bfe35 --- /dev/null +++ b/stories/earth_estries.yml @@ -0,0 +1,18 @@ +name: Earth Estries +id: 608135e2-eb6b-41bf-9f0c-b12f41a1376a +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Earth Estries, a sophisticated threat actor targeting various sectors with espionage-focused campaigns. Monitor for indicators such as spear-phishing emails, unauthorized access attempts, and lateral movement within your network. Investigate anomalous data exfiltration patterns and command-and-control (C2) traffic consistent with known tactics, techniques, and procedures (TTPs) of this group. Combining threat intelligence with advanced monitoring tools helps identify potential Earth Estries activity early, enabling swift response to mitigate risks effectively. +narrative: Earth Estries is a highly capable threat actor known for conducting targeted espionage campaigns against diverse sectors, including government, technology, and critical infrastructure. This group leverages sophisticated tactics such as spear-phishing, credential theft, and exploiting software vulnerabilities to gain initial access. Once inside a network, Earth Estries demonstrates expertise in lateral movement, privilege escalation, and covert data exfiltration. Their use of custom malware and command-and-control (C2) infrastructures highlights their adaptability. Detecting their activity requires robust threat intelligence and proactive monitoring of unusual behaviors and network anomalies. +references: +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/emotet_malware_dhs_report_ta18_201a.yml b/stories/emotet_malware_dhs_report_ta18_201a.yml index b651506c10..d148f02169 100644 --- a/stories/emotet_malware_dhs_report_ta18_201a.yml +++ b/stories/emotet_malware_dhs_report_ta18_201a.yml @@ -3,6 +3,7 @@ id: bb9f5ed2-916e-4364-bb6d-91c310efcf52 version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk +status: production description: Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has diff --git a/stories/f5_authentication_bypass_with_tmui.yml b/stories/f5_authentication_bypass_with_tmui.yml index 4aee82e248..37de0dd946 100644 --- a/stories/f5_authentication_bypass_with_tmui.yml +++ b/stories/f5_authentication_bypass_with_tmui.yml @@ -3,6 +3,7 @@ id: e4acbea6-75bb-4873-8c22-bc2da9525e89 version: 1 date: '2023-10-30' author: Michael Haag, Splunk +status: production description: "Research into leading software revealed vulnerabilities in both Apache Tomcat and the F5 BIG-IP suite. Apache's AJP protocol vulnerability, designated CVE-2022-26377, relates to AJP request smuggling. Successful exploitation enables unauthorized system activities. F5 BIG-IP Virtual Edition exhibited a distinct vulnerability, an authentication bypass in the Traffic Management User Interface (TMUI), resulting in system compromise. Assigned CVE-2023-46747, this vulnerability also arose from request smuggling, bearing similarity to CVE-2022-26377. Given the wide adoption of both Apache Tomcat and F5 products, these vulnerabilities present grave risks to organizations. Remediation and vulnerability detection mechanisms are essential to address these threats effectively." narrative: Both Apache Tomcat's AJP protocol and F5's BIG-IP Virtual Edition have been exposed to critical vulnerabilities. Apache's CVE-2022-26377 pertains to request smuggling by manipulating the "Transfer-Encoding" header. If successfully exploited, this allows attackers to bypass security controls and undertake unauthorized actions. diff --git a/stories/f5_big_ip_vulnerability_cve_2022_1388.yml b/stories/f5_big_ip_vulnerability_cve_2022_1388.yml index f53cabb2b5..02c49083a8 100644 --- a/stories/f5_big_ip_vulnerability_cve_2022_1388.yml +++ b/stories/f5_big_ip_vulnerability_cve_2022_1388.yml @@ -3,6 +3,7 @@ id: 0367b177-f8d6-4c4b-a62d-86f52a590bff version: 1 date: '2022-05-10' author: Michael Haag, Splunk +status: production description: CVE-2022-1388 is a unauthenticated remote code execution vulnerablity against BIG-IP iControl REST API. narrative: CVE-2022-1388 is a critical vulnerability (CVSS 9.8) in the management interface of F5 Networks'' BIG-IP solution that enables an unauthenticated attacker to gain remote code execution on the system through bypassing F5''s iControl REST authentication. The vulnerability was first discovered by F5''s internal product security team and disclosed publicly on May 4, 2022, per Randori. This vulnerability,CVE-2022-1388, may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only per F5 article K23605346. diff --git a/stories/f5_tmui_rce_cve_2020_5902.yml b/stories/f5_tmui_rce_cve_2020_5902.yml index 6e5a2148cd..f50a00638b 100644 --- a/stories/f5_tmui_rce_cve_2020_5902.yml +++ b/stories/f5_tmui_rce_cve_2020_5902.yml @@ -3,6 +3,7 @@ id: 7678c968-d46e-11ea-87d0-0242ac130003 version: 1 date: '2020-08-02' author: Shannon Davis, Splunk +status: production description: Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows diff --git a/stories/fin7.yml b/stories/fin7.yml index b79eb8d73c..04e667e2b5 100644 --- a/stories/fin7.yml +++ b/stories/fin7.yml @@ -3,6 +3,7 @@ id: df2b00d3-06ba-49f1-b253-b19cef19b569 version: 1 date: '2021-09-14' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and diff --git a/stories/flax_typhoon.yml b/stories/flax_typhoon.yml index 49c8455b05..b55d5f0aee 100644 --- a/stories/flax_typhoon.yml +++ b/stories/flax_typhoon.yml @@ -3,6 +3,7 @@ id: 78fadce9-a07f-4508-8d14-9b20052a62cc version: 1 date: '2023-08-25' author: Michael Haag, Splunk +status: production description: Microsoft has identified a nation-state activity group, Flax Typhoon, based in China, targeting Taiwanese organizations for espionage. The group maintains long-term access to networks with minimal use of malware, relying on built-in OS tools and benign software. The group's activities are primarily focused on Taiwan, but the techniques used could be easily reused in other operations outside the region. Microsoft has not observed Flax Typhoon using this access to conduct additional actions. narrative: Flax Typhoon has been active since mid-2021, targeting government agencies, education, critical manufacturing, and IT organizations in Taiwan. The group uses the China Chopper web shell, Metasploit, Juicy Potato privilege escalation tool, Mimikatz, and SoftEther VPN client. However, they primarily rely on living-off-the-land techniques and hands-on-keyboard activity. Initial access is achieved by exploiting known vulnerabilities in public-facing servers and deploying web shells. Following initial access, Flax Typhoon uses command-line tools to establish persistent access over the remote desktop protocol, deploy a VPN connection to actor-controlled network infrastructure, and collect credentials from compromised systems. The group also uses this VPN access to scan for vulnerabilities on targeted systems and organizations from the compromised systems. references: diff --git a/stories/forest_blizzard.yml b/stories/forest_blizzard.yml index 11eface337..5fdf57613c 100644 --- a/stories/forest_blizzard.yml +++ b/stories/forest_blizzard.yml @@ -3,6 +3,7 @@ id: 2c1aceda-f0a5-4c83-8543-e23ec1466958 version: 1 date: '2023-09-11' author: Michael Haag, Splunk +status: production description: CERT-UA has unveiled a cyberattack on Ukraine's energy infrastructure, orchestrated via deceptive emails. These emails, once accessed, lead to a multi-stage cyber operation downloading and executing malicious payloads. Concurrently, Zscaler's "Steal-It" campaign detection revealed striking similarities, hinting at a shared origin - APT28 or Fancy Bear. This notorious group, linked to Russia's GRU, utilizes legitimate platforms like Mockbin, making detection challenging. Their operations underline the evolving cyber threat landscape and stress the importance of advanced defenses. narrative: APT28, also known as Fancy Bear, blends stealth and expertise in its cyber operations. Affiliated with Russia's GRU, their signature move involves spear-phishing emails, leading to multi-tiered cyberattacks. In Ukraine's recent breach, a ZIP archive's execution triggered a series of actions, culminating in information flow redirection via the TOR network. Simultaneously, Zscaler's "Steal-It" campaign pinpointed similar tactics, specifically targeting NTLMv2 hashes. This campaign used ZIP archives containing LNK files to exfiltrate data via Mockbin. APT28's hallmark is their "Living Off The Land" strategy, manipulating legitimate tools and services to blend in, evading detection. Their innovative tactics, coupled with a geofencing focus on specific regions, make them a formidable cyber threat, highlighting the urgent need for advanced defense strategies. references: diff --git a/stories/fortinet_fortinac_cve_2022_39952.yml b/stories/fortinet_fortinac_cve_2022_39952.yml index 708838a003..f972d5030f 100644 --- a/stories/fortinet_fortinac_cve_2022_39952.yml +++ b/stories/fortinet_fortinac_cve_2022_39952.yml @@ -3,6 +3,7 @@ id: 2833a527-3b7f-41af-a950-39f7bbaff819 version: 1 date: '2023-02-21' author: Michael Haag, Splunk +status: production description: On Thursday, 16 February 2023, Fortinet released a PSIRT that details CVE-2022-39952, a critical vulnerability affecting its FortiNAC product (Horizon3.ai). narrative: This vulnerability, discovered by Gwendal Guegniaud of Fortinet, allows an unauthenticated attacker to write arbitrary files on the system and as a result obtain remote code execution in the context of the root user (Horizon3.ai). Impacting FortiNAC, is tracked as CVE-2022-39952 and has a CVSS v3 score of 9.8 (critical). diff --git a/stories/gcp_account_takeover.yml b/stories/gcp_account_takeover.yml index fdf6641eb2..232540adff 100644 --- a/stories/gcp_account_takeover.yml +++ b/stories/gcp_account_takeover.yml @@ -3,6 +3,7 @@ id: 8601caff-414f-4c6d-9a04-75b66778869d version: 1 date: '2022-10-12' author: Mauricio Velazco, Bhavin Patel, Splunk +status: production description: Monitor for activities and techniques associated with Account Takeover attacks against Google Cloud Platform tenants. narrative: 'Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, diff --git a/stories/gcp_cross_account_activity.yml b/stories/gcp_cross_account_activity.yml index ed222ab4f3..f7c24e533c 100644 --- a/stories/gcp_cross_account_activity.yml +++ b/stories/gcp_cross_account_activity.yml @@ -3,6 +3,7 @@ id: 0432039c-ef41-4b03-b157-450c25dad1e6 version: 1 date: '2020-09-01' author: Rod Soto, Splunk +status: production description: Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. diff --git a/stories/gomir.yml b/stories/gomir.yml index 515bb091e7..4a5c4c74a5 100644 --- a/stories/gomir.yml +++ b/stories/gomir.yml @@ -3,6 +3,7 @@ id: 02dbfda2-45fe-4731-a659-91fa871019ba version: 1 date: '2024-05-29' author: Teoderick Contreras, Splunk +status: production description: This analytic story includes detections that help security analysts identify and investigate unusual activities associated with the Gomir backdoor malware. Gomir is a sophisticated cyber threat that gains unauthorized access to systems. It communicates with a remote command-and-control (C2) server to execute malicious commands, steal diff --git a/stories/gozi_malware.yml b/stories/gozi_malware.yml index 5f54cdc3f4..06bb863062 100644 --- a/stories/gozi_malware.yml +++ b/stories/gozi_malware.yml @@ -3,6 +3,7 @@ id: a7332538-bb18-421e-874e-a20c9fcc34e7 version: 1 date: '2024-07-24' author: Michael Haag, Splunk +status: production description: This analytic story covers the detection and analysis of Gozi malware, also known as Ursnif or ISFB. Gozi is one of the oldest and most persistent banking trojans, with a history dating back to 2000. It has undergone numerous evolutions and code forks, resulting in several active variants in recent years. narrative: 'Gozi malware, first observed in 2006, has a complex lineage tracing back to the Ursnif/Snifula spyware from 2000. Over the years, it has evolved from a simple spyware to a sophisticated banking trojan, offered as Crimeware-as-a-Service (CaaS). Recent variants like Dreambot, IAP, RM2, RM3, and LDR4 demonstrate its ongoing development and threat. diff --git a/stories/graceful_wipe_out_attack.yml b/stories/graceful_wipe_out_attack.yml index c6aa134e1c..874e709974 100644 --- a/stories/graceful_wipe_out_attack.yml +++ b/stories/graceful_wipe_out_attack.yml @@ -3,6 +3,7 @@ id: 83b15b3c-6bda-45aa-a3b6-b05c52443f44 version: 1 date: '2023-06-15' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive attack or campaign found by "THE DFIR Report" that uses Truebot, FlawedGrace and MBR killer malware. This analytic story looks for suspicious dropped files, cobalt strike execution, im-packet execution, registry modification, scripts, diff --git a/stories/hafnium_group.yml b/stories/hafnium_group.yml index 3df3f902fe..b2de32324d 100644 --- a/stories/hafnium_group.yml +++ b/stories/hafnium_group.yml @@ -3,6 +3,7 @@ id: beae2ab0-7c3f-11eb-8b63-acde48001122 version: 1 date: '2021-03-03' author: Michael Haag, Splunk +status: production description: HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative: 'On Tuesday, March 2, 2021, Microsoft released a set of security patches diff --git a/stories/handala_wiper.yml b/stories/handala_wiper.yml index 5ae6560592..ee16a43719 100644 --- a/stories/handala_wiper.yml +++ b/stories/handala_wiper.yml @@ -3,6 +3,7 @@ id: 1590c46a-e976-4b4b-a166-d9be06ab0056 version: 1 date: '2024-07-31' author: Teoderick Contreras, Splunk +status: production description: Handala Destructive Wiper detection involves monitoring for suspicious activities such as unexpected `regasm` processes, unauthorized AutoIt script executions, and the dropping of malicious drivers. Indicators such as abrupt system slowdowns, and the creation of unknown files or processes. Early detection of these signs is crucial for mitigating the severe impact of this destructive malware. narrative: Handala Destructive Wiper is a potent malware strain known for its destructive capabilities. It targets and irreversibly wipes data from infected systems, rendering them inoperable. This malware is often used in cyber-attacks against critical infrastructure and organizations, causing significant disruption and data loss. This Wiper employs techniques to evade detection and spread rapidly across networks. Its deployment can lead to extensive downtime, financial loss, and compromised sensitive information, making it a severe threat in the cybersecurity landscape. references: diff --git a/stories/hermetic_wiper.yml b/stories/hermetic_wiper.yml index 5435256809..f3334cd04a 100644 --- a/stories/hermetic_wiper.yml +++ b/stories/hermetic_wiper.yml @@ -3,6 +3,7 @@ id: b7511c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more. narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting diff --git a/stories/hidden_cobra_malware.yml b/stories/hidden_cobra_malware.yml index 6a0dabf857..614cfa6d09 100644 --- a/stories/hidden_cobra_malware.yml +++ b/stories/hidden_cobra_malware.yml @@ -3,6 +3,7 @@ id: baf7580b-d4b4-4774-8173-7d198e9da335 version: 2 date: '2020-01-22' author: Rico Valdez, Splunk +status: production description: Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported diff --git a/stories/icedid.yml b/stories/icedid.yml index 9641e450ef..3344917afb 100644 --- a/stories/icedid.yml +++ b/stories/icedid.yml @@ -3,6 +3,7 @@ id: 1d2cc747-63d7-49a9-abb8-93aa36305603 version: 1 date: '2021-07-29' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection. diff --git a/stories/iis_components.yml b/stories/iis_components.yml index 42fea6e5a3..0c5917fbb0 100644 --- a/stories/iis_components.yml +++ b/stories/iis_components.yml @@ -3,6 +3,7 @@ id: 0fbde550-8252-43ab-a26a-03976f55b58b version: 1 date: '2022-12-19' author: Michael Haag, Splunk +status: production description: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. narrative: IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions - Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers. diff --git a/stories/industroyer2.yml b/stories/industroyer2.yml index 5cf0dfd0af..dd9e65c6d6 100644 --- a/stories/industroyer2.yml +++ b/stories/industroyer2.yml @@ -3,6 +3,7 @@ id: 7ff7db2b-b001-498e-8fe8-caf2dbc3428a version: 1 date: '2022-04-21' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Industroyer2 attack, including file writes associated with its payload, lateral movement, persistence, privilege escalation and data destruction. diff --git a/stories/information_sabotage.yml b/stories/information_sabotage.yml index 6ee67f3f8f..c00eec7908 100644 --- a/stories/information_sabotage.yml +++ b/stories/information_sabotage.yml @@ -3,6 +3,7 @@ id: b71ba595-ef80-4e39-8b66-887578a7a71b version: 1 date: '2021-11-17' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might correlate to insider threat specially in terms of information sabotage. narrative: Information sabotage is the type of crime many people associate with insider diff --git a/stories/ingress_tool_transfer.yml b/stories/ingress_tool_transfer.yml index 4cbcfb5a76..0bb0b12885 100644 --- a/stories/ingress_tool_transfer.yml +++ b/stories/ingress_tool_transfer.yml @@ -3,6 +3,7 @@ id: b3782036-8cbd-11eb-9d8e-acde48001122 version: 1 date: '2021-03-24' author: Michael Haag, Splunk +status: production description: Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the Command And Control channel to bring tools into the victim network diff --git a/stories/insider_threat.yml b/stories/insider_threat.yml index f8f425f404..623835b89a 100644 --- a/stories/insider_threat.yml +++ b/stories/insider_threat.yml @@ -3,6 +3,7 @@ id: c633df29-a950-4c4c-a0f8-02be6730797c version: 1 date: '2022-05-19' author: Jose Hernandez, Splunk +status: production description: Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment. narrative: "Insider Threats are best defined by CISA: \"Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs.\" An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats: Departing Employees, Security Evaders, Malicious Insiders, and Negligent Employees. This story aims at detecting the malicious insider." references: diff --git a/stories/ivanti_connect_secure_vpn_vulnerabilities.yml b/stories/ivanti_connect_secure_vpn_vulnerabilities.yml index e14d1b41d7..e2a272010e 100644 --- a/stories/ivanti_connect_secure_vpn_vulnerabilities.yml +++ b/stories/ivanti_connect_secure_vpn_vulnerabilities.yml @@ -3,6 +3,7 @@ id: e3b5c3b8-082b-4b4e-b2c9-47ed79e2a5ab version: 1 date: '2024-01-16' author: Michael Haag, Splunk +status: production description: The following analytic story addresses critical vulnerabilities CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure Gateways. CVE-2023-46805 is an authentication bypass vulnerability, while CVE-2024-21887 is a command injection flaw, both presenting significant risks in versions 9.x and 22.x. Combined, these vulnerabilities enable unauthenticated threat actors to execute arbitrary commands, compromising system integrity. Immediate mitigation is imperative, with patches scheduled for staggered release. Ivanti has provided interim mitigation steps, and it's crucial for customers to apply these measures to protect their systems against potential exploits. narrative: Ivanti Connect Secure and Ivanti Policy Secure gateways face a severe security challenge with the discovery of CVE-2023-46805 and CVE-2024-21887. CVE-2023-46805 allows attackers to bypass authentication in critical web components of versions 9.x and 22.x. More alarmingly, when paired with CVE-2024-21887, a command injection vulnerability, it enables remote attackers to execute arbitrary commands without authentication. This combination poses a heightened threat, undermining the security of enterprise networks. Ivanti has mobilized resources to address these vulnerabilities, offering immediate mitigation advice and scheduling patch releases. Customers are urged to apply these mitigations without delay to safeguard their networks. references: diff --git a/stories/ivanti_epm_vulnerabilities.yml b/stories/ivanti_epm_vulnerabilities.yml index aa170bc81e..2475583cc2 100644 --- a/stories/ivanti_epm_vulnerabilities.yml +++ b/stories/ivanti_epm_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 4dcadae4-df82-42f3-9e77-4d852d20ac78 version: 2 date: '2024-09-24' author: Michael Haag, Splunk +status: production description: |- This analytic story covers various vulnerabilities identified in Ivanti Endpoint Manager (EPM), including but not limited to SQL injection, remote code execution, and privilege escalation. These vulnerabilities can potentially be exploited by adversaries to gain unauthorized access, execute arbitrary code, and compromise the security of managed endpoints. narrative: |- diff --git a/stories/ivanti_epmm_remote_unauthenticated_access.yml b/stories/ivanti_epmm_remote_unauthenticated_access.yml index 8bbf25da4b..aadaf420e3 100644 --- a/stories/ivanti_epmm_remote_unauthenticated_access.yml +++ b/stories/ivanti_epmm_remote_unauthenticated_access.yml @@ -3,6 +3,7 @@ id: 7e36ca54-c096-4a39-b724-6fc935164f0c version: 2 date: '2023-08-08' author: Michael Haag, Splunk +status: production description: Ivanti, a leading technology company, has disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, CVE-2023-35078 and CVE-2023-35081. A recent update concerning CVE-2023-35082, closely related to CVE-2023-35078, reveals its impact on more versions of Ivanti's software than initially believed. The former allows unauthenticated attackers to obtain sensitive data, modify servers, and access the API, potentially leading to data breaches or malicious system modifications. Meanwhile, CVE-2023-35081 lets authenticated administrators remotely write arbitrary files to the server. Both vulnerabilities have been exploited in targeted attacks against government ministries and could be used in conjunction. With the presence of PoC code for CVE-2023-35078, the risk of broader exploitation has increased. While initially leveraged in limited attacks, the exploitation is expected to rise, possibly involving state-sponsored actors. Organizations are urged to apply immediate patches and conduct regular system assessments to ensure security. narrative: Ivantis Endpoint Manager Mobile (EPMM) product, formerly known as MobileIron Core and extensively utilized by IT teams to manage mobile devices, applications, and content, has been found to harbor several critical vulnerabilities. Specifically, CVE-2023-35078 allows remote unauthenticated attackers to access sensitive data and make changes to servers. This flaw has been leveraged in targeted attacks against Norwegian government ministries. In addition, CVE-2023-35081 permits an authenticated attacker with administrative privileges to remotely write arbitrary files to the server. diff --git a/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml b/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml index 36c87ad257..04d54b663c 100644 --- a/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml +++ b/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml @@ -3,6 +3,7 @@ id: da229be2-4637-47a5-b551-1d4b64f411c6 version: 1 date: '2023-08-24' author: Michael Haag, Splunk +status: production description: A critical vulnerability, designated as CVE-2023-38035, has been identified in Ivanti Sentry (formerly MobileIron Sentry). It affects all supported versions, including 9.18, 9.17, and 9.16, as well as older versions. The vulnerability allows an unauthenticated attacker to access the System Manager Portal (typically hosted on port 8443) and make configuration changes, potentially executing OS commands as root. However, the risk is low for users who haven't exposed port 8443 online. This flaw is distinct from other Ivanti products. It's imperative for organizations to check for unrecognized HTTP requests to /services/* as a potential indicator of compromise. narrative: CVE-2023-38035 presents a significant security risk in the Ivanti Sentry administration interface. The vulnerability was identified shortly after another notable vulnerability in Ivanti EPMM (CVE-2023-35078) was discovered being exploited in the wild. The current vulnerability allows a malicious actor, without requiring authentication, to access the System Manager Portal, typically hosted on port 8443. Upon successful exploitation, the attacker can make configuration alterations to both the Sentry system and its underlying OS. The potential damage is significant, enabling the attacker to execute commands on the system with root privileges. diff --git a/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml b/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml index d9c54b17e0..1832c940aa 100644 --- a/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml +++ b/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml @@ -3,6 +3,7 @@ id: 28e88e97-3494-45a6-87d5-76065cccf8d2 version: 1 date: '2024-08-19' author: Michael Haag, Splunk +status: production description: This analytic story addresses the critical authentication bypass vulnerability (CVE-2024-7593) in Ivanti Virtual Traffic Manager (vTM). Disclosed in August 2024, this flaw affects vTM versions prior to 22.2R1 and 22.7R2, allowing unauthenticated remote attackers to access the admin panel and create new administrator accounts. Such access could potentially lead to full system compromise. The story provides detections for potential exploitation attempts, focusing on unauthorized account creation and suspicious administrative activities. It aims to help organizations identify and respond to possible attacks leveraging this vulnerability, emphasizing the importance of timely patching and thorough investigation of any suspicious events. narrative: In August 2024, a critical vulnerability (CVE-2024-7593) was disclosed in Ivanti Virtual Traffic Manager (vTM) versions prior to 22.2R1 and 22.7R2. This authentication bypass flaw allows unauthenticated remote attackers to access the admin panel and create new administrator accounts, potentially leading to full system compromise. Exploitation of this vulnerability typically involves an attacker accessing the vTM management interface, bypassing authentication using the vulnerability, creating a new administrator account without proper authorization, and potentially using the new account for further malicious activities. This analytic story includes detections to identify suspicious account creation events and other indicators of exploitation. It is crucial for organizations using affected Ivanti vTM versions to update to a patched version immediately and investigate any potential compromise. By leveraging these detections, security teams can enhance their ability to detect and respond to potential attacks exploiting this critical vulnerability in their Ivanti vTM deployments. references: diff --git a/stories/jboss_vulnerability.yml b/stories/jboss_vulnerability.yml index c138e1c36a..beb3d4f053 100644 --- a/stories/jboss_vulnerability.yml +++ b/stories/jboss_vulnerability.yml @@ -3,6 +3,7 @@ id: 1f5294cb-b85f-4c2d-9c58-ffcf248f52bd version: 1 date: '2017-09-14' author: Bhavin Patel, Splunk +status: production description: In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources diff --git a/stories/jenkins_server_vulnerabilities.yml b/stories/jenkins_server_vulnerabilities.yml index 0f1a4727c3..20db656ed4 100644 --- a/stories/jenkins_server_vulnerabilities.yml +++ b/stories/jenkins_server_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 789e76e6-4b5e-4af3-ab8c-46578d84ccff version: 1 date: '2024-01-29' author: Michael Haag, Splunk +status: production description: This analytic story provides a comprehensive view of Jenkins server vulnerabilities and associated detection analytics. narrative: The following analytic story provides a comprehensive view of Jenkins server vulnerabilities and associated detection analytics. Jenkins is a popular open-source automation server that is used to automate tasks associated with building, testing, and deploying software. Jenkins is often used in DevOps environments and is a critical component of the software development lifecycle. As a result, Jenkins servers are often targeted by adversaries to gain access to sensitive information, credentials, and other critical assets. This analytic story provides a comprehensive view of Jenkins server vulnerabilities and associated detection analytics. references: diff --git a/stories/jetbrains_teamcity_unauthenticated_rce.yml b/stories/jetbrains_teamcity_unauthenticated_rce.yml index 7845795041..51b746ebc5 100644 --- a/stories/jetbrains_teamcity_unauthenticated_rce.yml +++ b/stories/jetbrains_teamcity_unauthenticated_rce.yml @@ -3,6 +3,7 @@ id: 7ef2d230-9dbb-4d13-9263-a7d8c3aad9bf version: 1 date: '2023-10-01' author: Michael Haag, Splunk +status: production description: A critical security vulnerability, CVE-2023-42793, has been discovered affecting all versions of TeamCity On-Premises up to 2023.05.3. This vulnerability allows unauthenticated attackers to execute remote code and gain administrative control of the TeamCity server, posing a significant risk for supply chain attacks. Although the issue has been fixed in version 2023.05.4, servers running older versions remain at risk. A security patch plugin has been released for immediate mitigation, applicable to TeamCity versions 8.0 and above. Organizations are strongly advised to update to the fixed version or apply the security patch, especially if their TeamCity server is publicly accessible. No impact has been reported on TeamCity Cloud as it has been upgraded to the secure version. narrative: The CVE-2023-42793 vulnerability in TeamCity On-Premises allows an unauthenticated attacker to bypass authentication and gain administrative access through Remote Code Execution (RCE). Specifically, the attacker can send a malicious POST request to /app/rest/users/id:1/tokens/RPC2 to create an administrative token. Once the token is obtained, the attacker has the ability to perform various unauthorized activities, including creating new admin users and executing arbitrary shell commands on the server. For Splunk Security Content, the focus should be on identifying suspicious POST requests to /app/rest/users/id:1/tokens/RPC2 and other affected API endpoints, as this is the initial point of exploitation. Monitoring logs for changes to the internal.properties file or the creation of new admin users could also provide crucial indicators of compromise. Furthermore, Splunk can be configured to alert on multiple failed login attempts followed by a successful login from the same IP, which could indicate exploitation attempts. diff --git a/stories/jetbrains_teamcity_vulnerabilities.yml b/stories/jetbrains_teamcity_vulnerabilities.yml index 99603ed663..80046e8aca 100644 --- a/stories/jetbrains_teamcity_vulnerabilities.yml +++ b/stories/jetbrains_teamcity_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 3cd841e8-2f64-45e8-b148-7767255db111 version: 1 date: '2024-03-04' author: Michael Haag, Splunk +status: production description: This story provides a high-level overview of JetBrains TeamCity vulnerabilities and how to detect and respond to them using Splunk. narrative: JetBrains TeamCity is a continuous integration and deployment server that allows developers to automate the process of building, testing, and deploying code. It is a popular tool used by many organizations to streamline their development and deployment processes. However, like any software, JetBrains TeamCity is not immune to vulnerabilities. references: diff --git a/stories/juniper_junos_remote_code_execution.yml b/stories/juniper_junos_remote_code_execution.yml index 5f4e0be4cc..28138bd251 100644 --- a/stories/juniper_junos_remote_code_execution.yml +++ b/stories/juniper_junos_remote_code_execution.yml @@ -3,6 +3,7 @@ id: 3fcef843-c97e-4cf3-a72f-749be480cee3 version: 1 date: '2023-08-29' author: Michael Haag, Splunk +status: production description: Juniper Networks has resolved multiple critical vulnerabilities in the J-Web component of Junos OS on SRX and EX Series devices. These vulnerabilities, when chained together, could allow an unauthenticated, network-based attacker to remotely execute code on the devices. The vulnerabilities affect all versions of Junos OS on SRX and EX Series, but specific fixes have been released to address each vulnerability. Juniper Networks recommends applying the necessary fixes to mitigate potential remote code execution threats. As a workaround, users can disable J-Web or limit access to only trusted hosts. Proof-of-concept (PoC) exploit code has been released, demonstrating the severity of these flaws and the urgency to apply the fixes. narrative: Juniper Networks, a networking hardware company, has released an "out-of-cycle" security update to address multiple flaws in the J-Web component of Junos OS that could be combined to achieve remote code execution on susceptible installations. The flaws have a cumulative CVSS rating of 9.8, making them critical in severity. They affect all versions of Junos OS on SRX and EX Series. The J-Web interface allows users to configure, manage, and monitor Junos OS devices. The vulnerabilities include two PHP external variable modification vulnerabilities (CVE-2023-36844 and CVE-2023-36845) and two missing authentications for critical function vulnerabilities (CVE-2023-36846 and CVE-2023-36847). These vulnerabilities could allow an unauthenticated, network-based attacker to control certain important environment variables, cause limited impact to the file system integrity, or upload arbitrary files via J-Web without any authentication. diff --git a/stories/kubernetes_scanning_activity.yml b/stories/kubernetes_scanning_activity.yml index 513e47012d..7c58c7452a 100644 --- a/stories/kubernetes_scanning_activity.yml +++ b/stories/kubernetes_scanning_activity.yml @@ -3,6 +3,7 @@ id: a9ef59cf-e981-4e66-9eef-bb049f695c09 version: 1 date: '2020-04-15' author: Rod Soto, Splunk +status: production description: This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. diff --git a/stories/kubernetes_security.yml b/stories/kubernetes_security.yml index 06cf7ad5da..d22d14e2dc 100644 --- a/stories/kubernetes_security.yml +++ b/stories/kubernetes_security.yml @@ -3,6 +3,7 @@ id: 77006b3a-306c-4e32-afd5-30b6e40c1c41 version: 1 date: '2023-12-06' author: 'Patrick Bareiss' +status: production description: Kubernetes, as a container orchestration platform, faces unique security challenges. This story explores various tactics and techniques adversaries use to exploit Kubernetes environments, including attacking the control plane, exploiting misconfigurations, and compromising containerized applications. narrative: diff --git a/stories/kubernetes_sensitive_object_access_activity.yml b/stories/kubernetes_sensitive_object_access_activity.yml index 25f8925529..156b0a374a 100644 --- a/stories/kubernetes_sensitive_object_access_activity.yml +++ b/stories/kubernetes_sensitive_object_access_activity.yml @@ -3,6 +3,7 @@ id: c7d4dbf0-a171-4eaf-8444-4f40392e4f92 version: 1 date: '2020-05-20' author: Rod Soto, Splunk +status: production description: This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. diff --git a/stories/linux_living_off_the_land.yml b/stories/linux_living_off_the_land.yml index 168a050fe4..acecbea633 100644 --- a/stories/linux_living_off_the_land.yml +++ b/stories/linux_living_off_the_land.yml @@ -3,6 +3,7 @@ id: e405a2d7-dc8e-4227-8e9d-f60267b8c0cd version: 1 date: '2022-07-27' author: Michael Haag, Splunk +status: production description: Linux Living Off The Land consists of binaries that may be used to bypass local security restrictions within misconfigured systems. narrative: Similar to Windows LOLBAS project, the GTFOBins project focuses solely on Unix binaries that may be abused in multiple categories including Reverse Shell, File Upload, File Download and much more. These binaries are native to the operating system and the functionality is typically native. The behaviors are typically not malicious by default or vulnerable, but these are built in functionality of the applications. diff --git a/stories/linux_persistence_techniques.yml b/stories/linux_persistence_techniques.yml index 689adb4398..51db20dc85 100644 --- a/stories/linux_persistence_techniques.yml +++ b/stories/linux_persistence_techniques.yml @@ -3,6 +3,7 @@ id: e40d13e5-d38b-457e-af2a-e8e6a2f2b516 version: 1 date: '2021-12-17' author: Teoderick Contreras, Splunk +status: production description: Monitor for activities and techniques associated with maintaining persistence on a Linux system--a sign that an adversary may have compromised your environment. narrative: Maintaining persistence is one of the first steps taken by attackers after diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml index 8282d7c9aa..9054a00230 100644 --- a/stories/linux_post_exploitation.yml +++ b/stories/linux_post_exploitation.yml @@ -3,6 +3,7 @@ id: d310ccfe-5477-11ec-ad05-acde48001122 version: 1 date: '2021-12-03' author: Rod Soto +status: production description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin. narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version. references: diff --git a/stories/linux_privilege_escalation.yml b/stories/linux_privilege_escalation.yml index 6f05f0104b..a8303efda3 100644 --- a/stories/linux_privilege_escalation.yml +++ b/stories/linux_privilege_escalation.yml @@ -3,6 +3,7 @@ id: b9879c24-670a-44c0-895e-98cdb7d0e848 version: 1 date: '2021-12-17' author: Teoderick Contreras, Splunk +status: production description: Monitor for and investigate activities that may be associated with a Linux privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more. diff --git a/stories/linux_rootkit.yml b/stories/linux_rootkit.yml index fba28ae4af..5f54a85eef 100644 --- a/stories/linux_rootkit.yml +++ b/stories/linux_rootkit.yml @@ -3,6 +3,7 @@ id: e30f4054-ac08-4999-b8bc-5cc46886c18d version: 1 date: '2022-07-27' author: Michael Haag, Splunk +status: production description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. narrative: Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems. Linux rootkits may not standout as much as a Windows rootkit, therefore understanding what kernel modules are installed today and monitoring for new is important. As with any rootkit, it may blend in using a common kernel name or variation of legitimate names. diff --git a/stories/living_off_the_land.yml b/stories/living_off_the_land.yml index 01672b577a..9661923ab3 100644 --- a/stories/living_off_the_land.yml +++ b/stories/living_off_the_land.yml @@ -3,6 +3,7 @@ id: 6f7982e2-900b-11ec-a54a-acde48001122 version: 2 date: '2022-03-16' author: Lou Stella, Splunk +status: production description: Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. references: diff --git a/stories/local_privilege_escalation_with_krbrelayup.yml b/stories/local_privilege_escalation_with_krbrelayup.yml index 668be242c0..0ff950dde9 100644 --- a/stories/local_privilege_escalation_with_krbrelayup.yml +++ b/stories/local_privilege_escalation_with_krbrelayup.yml @@ -3,6 +3,7 @@ id: 765790f0-2f8f-4048-8321-fd1928ec2546 version: 1 date: '2022-04-28' author: Michael Haag, Mauricio Velazco, Splunk +status: production description: KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers. narrative: In October 2021, James Forshaw from Googles Project Zero released a research blog post titled `Using Kerberos for Authentication Relay Attacks`. This research introduced, for the first time, ways to make Windows authenticate to a different Service Principal Name (SPN) than what would normally be derived from the hostname the client is connecting to. diff --git a/stories/lockbit_ransomware.yml b/stories/lockbit_ransomware.yml index 72821f3cde..cef23f6903 100644 --- a/stories/lockbit_ransomware.yml +++ b/stories/lockbit_ransomware.yml @@ -3,6 +3,7 @@ id: 67e5b98d-16d6-46a6-8d00-070a3d1a5cfc version: 1 date: '2023-01-16' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the LockBit ransomware, including looking for file writes (file encryption and ransomware notes), deleting services, terminating processes, registry key modification and more. diff --git a/stories/log4shell_cve_2021_44228.yml b/stories/log4shell_cve_2021_44228.yml index 60b52778d9..eed0cdb2fa 100644 --- a/stories/log4shell_cve_2021_44228.yml +++ b/stories/log4shell_cve_2021_44228.yml @@ -3,6 +3,7 @@ id: b4453928-5a98-11ec-afcd-8de10b48fc52 version: 1 date: '2021-12-11' author: Jose Hernandez +status: production description: Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute diff --git a/stories/lumma_stealer.yml b/stories/lumma_stealer.yml index eb0a23e343..09dfbad898 100644 --- a/stories/lumma_stealer.yml +++ b/stories/lumma_stealer.yml @@ -3,6 +3,7 @@ id: 6c8f76f6-1272-4c0e-afbd-5a9f58947fa5 version: 1 date: '2024-11-13' author: Michael Haag, Nasreddine Bencherchali, Splunk +status: production description: Lumma Stealer is a sophisticated information-stealing malware that has been operating as a Malware-as-a-Service (MaaS) platform since 2022. Recent campaigns in 2024 have shown increased sophistication in distribution methods, particularly through fake CAPTCHA verification pages, cracked game downloads, and phishing emails targeting GitHub users. The malware is designed to steal sensitive information including browser credentials, cryptocurrency wallet data, and password manager archives. narrative: As of late 2024, Lumma Stealer has emerged as one of the most prominent information stealers in the threat landscape, employing increasingly sophisticated distribution techniques. The malware's primary infection vector involves a deceptive CAPTCHA campaign where attackers create convincing phishing sites featuring fake Google CAPTCHA verification pages. When users interact with these pages by clicking "I'm not a robot," malicious code is automatically copied to their clipboard. Users are then socially engineered to paste this code into the Windows Run dialog (Win+R), triggering PowerShell commands that download and execute the Lumma Stealer payload. / diff --git a/stories/malicious_powershell.yml b/stories/malicious_powershell.yml index 402f1ceb0e..54fa231415 100644 --- a/stories/malicious_powershell.yml +++ b/stories/malicious_powershell.yml @@ -3,6 +3,7 @@ id: 2c8ff66e-0b57-42af-8ad7-912438a403fc version: 5 date: '2017-08-23' author: David Dorsey, Splunk +status: production description: Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate diff --git a/stories/masquerading___rename_system_utilities.yml b/stories/masquerading___rename_system_utilities.yml index 53dfe57ce1..245b7f5747 100644 --- a/stories/masquerading___rename_system_utilities.yml +++ b/stories/masquerading___rename_system_utilities.yml @@ -3,6 +3,7 @@ id: f0258af4-a6ae-11eb-b3c2-acde48001122 version: 1 date: '2021-04-26' author: Michael Haag, Splunk +status: production description: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. narrative: 'Security monitoring and control mechanisms may be in place for system diff --git a/stories/meduza_stealer.yml b/stories/meduza_stealer.yml index b634ad526b..1def57797a 100644 --- a/stories/meduza_stealer.yml +++ b/stories/meduza_stealer.yml @@ -3,6 +3,7 @@ id: c3328a8a-565b-435e-b9cc-5410e34b821b version: 1 date: '2024-11-28' author: Teoderick Contreras, Splunk +status: production description: Meduza Stealer is a sophisticated and rapidly evolving malware designed to extract sensitive data from compromised systems. Detected primarily through anomalous network activities, its behavior often involves outbound connections to command-and-control (C2) servers, encrypting and exfiltrating stolen credentials, financial data, and other personal information. Analysts have identified Meduza Stealer leveraging advanced evasion techniques, including dynamic obfuscation, anti-analysis methods, and the use of polymorphic code to bypass detection by traditional antivirus systems. Once deployed, it scans for browser-stored passwords, cryptocurrency wallets, and keylogging opportunities, potentially exploiting unpatched software vulnerabilities. Security tools flag it through heuristic detections, anomalous process executions, or unusual registry modifications. Meduza Stealer's malicious payloads are often distributed via phishing emails, malicious attachments, or trojanized software downloads. Effective defense requires a multi-layered security approach, regular software updates, and employee training to minimize risks posed by this potent cyber threat. narrative: Meduza Stealer is a relatively new entrant in the cybercrime landscape, first identified in early 2023. It quickly gained notoriety among threat actors for its effectiveness and adaptability. Designed as a data-stealing malware, it targets sensitive information such as login credentials, financial details, and cryptocurrency wallets. Its developers market it on underground forums, often touting its advanced features like dynamic obfuscation and anti-analysis mechanisms, making it difficult for traditional antivirus solutions to detect. Meduza Stealer typically spreads through phishing campaigns, malicious email attachments, and trojanized software downloads. Once executed, it infiltrates systems silently, harvesting data from web browsers, password managers, and clipboard activities. It then transmits the stolen information to its command-and-control (C2) servers using encrypted communication channels, further complicating detection and analysis. Security researchers have noted its use of polymorphic code, enabling it to modify its structure with each infection to evade heuristic and signature-based detection methods.Meduza Stealer highlights a growing trend in sophisticated, modular malware that appeals to cybercriminals due to its efficiency and ease of deployment. Effective mitigation strategies include adopting behavioral analysis tools, implementing robust endpoint security solutions, and maintaining user awareness through regular cybersecurity training. Proactive measures are essential to combat the escalating threat posed by this advanced malware. references: diff --git a/stories/metasploit.yml b/stories/metasploit.yml index 4d5ccde433..ce914f9248 100644 --- a/stories/metasploit.yml +++ b/stories/metasploit.yml @@ -3,6 +3,7 @@ id: c149b694-bd08-4535-88d3-1f288a66313f version: 1 date: '2022-11-21' author: Michael Haag, Splunk +status: production description: The following analytic story highlights content related directly to MetaSploit, which may be default configurations attributed to MetaSploit or behaviors of known knowns that are related. narrative: 'The Metasploit framework is a very powerful tool which can be used by cybercriminals as well as ethical hackers to probe systematic vulnerabilities on networks and servers. Because it is an open-source framework, it can be easily customized and used with most operating systems. diff --git a/stories/meterpreter.yml b/stories/meterpreter.yml index c25790918e..b1fffe827c 100644 --- a/stories/meterpreter.yml +++ b/stories/meterpreter.yml @@ -3,6 +3,7 @@ id: d5f8e298-c85a-11eb-9fea-acde48001122 version: 1 date: '2021-06-08' author: Michael Hart +status: production description: Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. diff --git a/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml b/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml index 1aa4aa9703..fdf5a657dc 100644 --- a/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml +++ b/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml @@ -3,6 +3,7 @@ id: 4ad4253e-10ca-11ec-8235-acde48001122 version: 1 date: '2021-09-08' author: Michael Haag, Splunk +status: production description: CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents. narrative: "Microsoft is aware of targeted attacks that attempt to exploit this vulnerability, diff --git a/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml b/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml index 7e0a978864..47ca482750 100644 --- a/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml +++ b/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml @@ -3,6 +3,7 @@ id: 95ae800d-485e-47f7-866e-8be281aa497d version: 1 date: '2023-09-27' author: Michael Haag, Gowthamaraj Rajendran, Splunk +status: production description: This analytic story focuses on the Microsoft SharePoint Server vulnerability CVE-2023-29357, which allows for an elevation of privilege due to improper handling of authentication tokens. Exploitation of this vulnerability could lead to a serious security breach where an attacker might gain privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities. This story is associated with the detection `Microsoft SharePoint Server Elevation of Privilege` which identifies attempts to exploit this vulnerability. narrative: Microsoft SharePoint Server is a widely used web-based collaborative platform. The vulnerability CVE-2023-29357 exposes a flaw in the handling of authentication tokens, allowing an attacker to escalate privileges and gain unauthorized access to the SharePoint environment. This could potentially lead to data theft, unauthorized system modifications, or other malicious activities. Organizations are urged to apply immediate patches and conduct regular system assessments to ensure security. references: diff --git a/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml index cff32f2ea0..e158f7399c 100644 --- a/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml +++ b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml @@ -3,6 +3,7 @@ id: 2a60a99e-c93a-4036-af70-768fac838019 version: 1 date: '2022-05-31' author: 'Michael Haag, Teoderick Contreras, Splunk' +status: production description: On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. narrative: A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights. diff --git a/stories/monitor_for_updates.yml b/stories/monitor_for_updates.yml index 7dbddf4806..4192362390 100644 --- a/stories/monitor_for_updates.yml +++ b/stories/monitor_for_updates.yml @@ -3,6 +3,7 @@ id: 9ef8d677-7b52-4213-a038-99cfc7acc2d8 version: 1 date: '2017-09-15' author: Rico Valdez, Splunk +status: production description: Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches. diff --git a/stories/moonpeak.yml b/stories/moonpeak.yml index 01e6ffb4b2..dc35f041f2 100644 --- a/stories/moonpeak.yml +++ b/stories/moonpeak.yml @@ -3,6 +3,7 @@ id: b32c2bb4-ddb0-402f-a05d-9eae0ef4007a version: 1 date: '2024-08-21' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities linked to the MoonPeak malware, particularly focusing on command-and-control (C2) communications, data collection, file execution, and persistence mechanisms. Monitor network traffic for connections to known malicious IP addresses or domains associated with North Korean APT groups. Additionally, identify unexpected registry modifications and the presence of unauthorized binaries to uncover potential MoonPeak infections. narrative: The MoonPeak malware is a sophisticated cyber threat attributed to North Korean advanced persistent threat (APT) groups. This malware is designed to infiltrate targeted systems, establish persistence, and communicate with command-and-control (C2) servers, enabling remote attackers to execute malicious activities. MoonPeak often evades detection by leveraging encryption and obfuscation techniques, making it challenging for traditional security measures to identify its presence. It primarily targets government entities, critical infrastructure, and organizations of strategic interest, with the ultimate goal of espionage, data exfiltration, and disruption of operations. Its evolving tactics highlight the growing complexity of nation-state cyber operations. references: diff --git a/stories/moveit_transfer_authentication_bypass.yml b/stories/moveit_transfer_authentication_bypass.yml index d2dcbbd367..0e250786c9 100644 --- a/stories/moveit_transfer_authentication_bypass.yml +++ b/stories/moveit_transfer_authentication_bypass.yml @@ -3,6 +3,7 @@ id: b4c0b91f-eee5-47fd-ab02-11f68a9c0858 version: 1 date: '2024-06-28' author: Michael Haag, Splunk +status: production description: 'This analytic story addresses the critical authentication bypass vulnerability (CVE-2024-5806) in Progress MOVEit Transfer. The vulnerability allows attackers to impersonate any valid user on the system without proper credentials, potentially leading to unauthorized access, data theft, and system compromise. This story includes detections for key indicators of exploitation attempts, helping security teams identify and respond to potential attacks leveraging this vulnerability.' narrative: 'In June 2024, a severe authentication bypass vulnerability (CVE-2024-5806) was discovered in Progress MOVEit Transfer, a widely used file transfer solution. This vulnerability allows attackers to bypass authentication and impersonate any valid user on the system, even without prior access or the ability to upload files. diff --git a/stories/moveit_transfer_critical_vulnerability.yml b/stories/moveit_transfer_critical_vulnerability.yml index ba280b2fc9..a75ac0abb8 100644 --- a/stories/moveit_transfer_critical_vulnerability.yml +++ b/stories/moveit_transfer_critical_vulnerability.yml @@ -3,6 +3,7 @@ id: e8c05f9b-6ad4-45ac-8f5d-ff044da417c9 version: 1 date: '2023-06-01' author: Michael Haag, Splunk +status: production description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEitTransfer\wwwroot\ folder for unusual files. A patch is currently released. narrative: 'Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads. diff --git a/stories/netsh_abuse.yml b/stories/netsh_abuse.yml index a0b592b345..128d4a00f0 100644 --- a/stories/netsh_abuse.yml +++ b/stories/netsh_abuse.yml @@ -3,6 +3,7 @@ id: 2b1800dd-92f9-47ec-a981-fdf1351e5f65 version: 1 date: '2017-01-05' author: Bhavin Patel, Splunk +status: production description: Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. diff --git a/stories/network_discovery.yml b/stories/network_discovery.yml index 72008e8b8b..7d260e5bd3 100644 --- a/stories/network_discovery.yml +++ b/stories/network_discovery.yml @@ -3,6 +3,7 @@ id: af228995-f182-49d7-90b3-2a732944f00f version: 1 date: '2022-02-14' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, firewall settings and many more. diff --git a/stories/nexus_apt_threat_activity.yml b/stories/nexus_apt_threat_activity.yml new file mode 100644 index 0000000000..bd6aed1350 --- /dev/null +++ b/stories/nexus_apt_threat_activity.yml @@ -0,0 +1,21 @@ +name: Nexus APT Threat Activity +id: 43f8062d-4da0-4f48-8cad-6a20e108961b +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, an advanced persistent threat (APT) group known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. +narrative: Chinese state-nexus threat actors are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. +references: +- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/ +- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink +- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf +- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/njrat.yml b/stories/njrat.yml index 325156be0d..2f52c8e678 100644 --- a/stories/njrat.yml +++ b/stories/njrat.yml @@ -3,6 +3,7 @@ id: f6d52454-6cf3-4759-9627-5868a3e2b2b1 version: 2 date: '2023-09-07' author: Teoderick Contreras, Splunk +status: production description: NjRat is a notorious remote access trojan (RAT) predominantly wielded by malicious operators to infiltrate and wield remote control over compromised systems. This analytical story harnesses targeted search methodologies to uncover and investigate activities that could be indicative of NjRAT's presence. These activities include tracking file write operations for dropped files, scrutinizing registry modifications aimed at establishing persistence mechanisms, diff --git a/stories/nobelium_group.yml b/stories/nobelium_group.yml index 383a4590e8..f064d0c4f3 100644 --- a/stories/nobelium_group.yml +++ b/stories/nobelium_group.yml @@ -3,6 +3,7 @@ id: 758196b5-2e21-424f-a50c-6e421ce926c2 version: 3 date: '2020-12-14' author: Patrick Bareiss, Michael Haag, Mauricio Velazco, Splunk +status: production description: NOBELIUM, also known as APT29, The Dukes, Cozy Bear, CozyDuke, Blue Kitsune, and Midnight Blizzard, is a sophisticated nation-state threat actor, reportedly associated with Russian intelligence. Active since at least 2008, this group primarily targets government networks in Europe and NATO member countries, along with research institutes and think tanks. Their operations typically involve advanced persistent threats (APT), leveraging techniques like spear-phishing, malware deployment, and long-term network compromise to achieve information theft and espionage. Notably, APT29 has been implicated in significant cyber espionage incidents, including the 2015 breach of the Pentagon's Joint Staff email system and attacks on the Democratic National Committee in 2016. Their advanced tactics and persistent approach underscore the serious nature of threats posed by this group to global cybersecurity. narrative: This Analytic Story groups detections designed to trigger on a comprehensive range of Tactics, Techniques, and Procedures (TTPs) leveraged by the NOBELIUM Group, with a focus on their methods as observed in well-known public breaches. references: diff --git a/stories/office_365_account_takeover.yml b/stories/office_365_account_takeover.yml index c48d646683..5c7c84160a 100644 --- a/stories/office_365_account_takeover.yml +++ b/stories/office_365_account_takeover.yml @@ -3,6 +3,7 @@ id: 7dcea963-af44-4db7-a5b9-fd2b543d9bc9 version: 1 date: '2023-10-17' author: Mauricio Velazco, Patrick Bareiss, Splunk +status: production description: Monitor for activities and anomalies indicative of initial access techniques within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. O365's centralized storage of sensitive data and widespread adoption make it a key asset, yet also a prime target for security threats. The "Office 365 Account Takeover" analytic story focuses on the initial techniques attackers employ to breach or compromise these identities. Initial access, in this context, consists of techniques that use various entry vectors to gain their initial foothold . Identifying these early indicators is crucial for establishing the first line of defense against unauthorized access and potential security incidents within O365 environments. references: diff --git a/stories/office_365_collection_techniques.yml b/stories/office_365_collection_techniques.yml index a3a1141b14..b9fae2a9a4 100644 --- a/stories/office_365_collection_techniques.yml +++ b/stories/office_365_collection_techniques.yml @@ -3,6 +3,7 @@ id: d90f2b80-f675-4717-90af-12fc8c438ae8 version: 1 date: '2024-02-12' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and anomalies indicative of potential collection techniques within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. O365's centralized storage of sensitive data and widespread adoption make it a key asset, yet also a prime target for security threats. The 'Office 365 Collection Techniques' analytic story focuses on the strategies and methodologies that attackers might use to gather critical information within the O365 ecosystem. 'Collection' in this context refers to the various techniques adversaries deploy to accumulate data that are essential for advancing their malicious objectives. This could include tactics such as intercepting communications, accessing sensitive documents, or extracting data from collaboration tools and email platforms. By identifying and monitoring these collection activities, organizations can more effectively spot and counteract attempts to illicitly gather information references: [] diff --git a/stories/office_365_persistence_mechanisms.yml b/stories/office_365_persistence_mechanisms.yml index 7d0d386339..e49db88ddb 100644 --- a/stories/office_365_persistence_mechanisms.yml +++ b/stories/office_365_persistence_mechanisms.yml @@ -3,6 +3,7 @@ id: d230a106-0475-4605-a8d8-abaf4c31ced7 version: 1 date: '2023-10-17' author: Mauricio Velazco, Patrick Bareiss, Splunk +status: production description: Monitor for activities and anomalies indicative of potential persistence techniques within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. O365's centralized storage of sensitive data and widespread adoption make it a key asset, yet also a prime target for security threats. The "Office 365 Persistence Mechanisms" analytic story delves into the tactics and techniques attackers employ to maintain prolonged unauthorized access within the O365 environment. Persistence in this context refers to methods used by adversaries to keep their foothold after an initial compromise. This can involve actions like modifying mailbox rules, establishing covert forwarding rules, manipulating application permissions. By monitoring signs of persistence, organizations can effectively detect and respond to stealthy threats, thereby protecting their O365 assets and data. references: diff --git a/stories/okta_account_takeover.yml b/stories/okta_account_takeover.yml index 2447c01a8e..62bcd47abb 100644 --- a/stories/okta_account_takeover.yml +++ b/stories/okta_account_takeover.yml @@ -3,6 +3,7 @@ id: 83a48657-8153-4580-adba-eb0b3a83244e version: 1 date: '2024-03-06' author: Michael Haag, Mauricio Velazco, Bhavin Patel, Splunk +status: production description: The Okta Account Takeover analytic story encompasses a comprehensive suite of detections aimed at identifying unauthorized access and potential takeover attempts of Okta accounts. This collection leverages diverse data points and behavioral analytics to safeguard user identities and access within cloud environments. Monitor for activities and techniques associated with Account Takeover attacks against Okta tenants. narrative: Okta is a cloud-based identity management service that provides organizations with a secure way to manage user access to various applications and services. It enables single sign-on (SSO), multi-factor authentication (MFA), lifecycle management, and more, helping organizations streamline the user authentication process. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, access sensitive applications, or use any stolen information to access further accounts within the organization. This analytic story groups detections that can help security operations teams identify the potential compromise of Okta accounts. references: diff --git a/stories/okta_mfa_exhaustion.yml b/stories/okta_mfa_exhaustion.yml index ef6de41294..4bef5350dd 100644 --- a/stories/okta_mfa_exhaustion.yml +++ b/stories/okta_mfa_exhaustion.yml @@ -3,6 +3,7 @@ id: 7c6e508d-4b4d-42c8-82de-5ff4ea3b0cb3 version: 1 date: '2022-09-27' author: Michael Haag, Splunk +status: production description: A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks. narrative: An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device. The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of "fatigue" regarding these MFA prompts. diff --git a/stories/openssl_cve_2022_3602.yml b/stories/openssl_cve_2022_3602.yml index 8098e9f587..a5bab157e7 100644 --- a/stories/openssl_cve_2022_3602.yml +++ b/stories/openssl_cve_2022_3602.yml @@ -3,6 +3,7 @@ id: 491e00c9-998b-4c64-91bb-d8f9c79c1f4c version: 1 date: '2022-11-02' author: Michael Haag, splunk +status: production description: OpenSSL recently disclosed two vulnerabilities CVE-2022-3602 and CVE-2022-3786. CVE-2022-3602 is a X.509 Email Address 4-byte Buffer Overflow where puny code is utilized. This only affects OpenSSL 3.0.0 - 3.0.6. narrative: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after diff --git a/stories/orangeworm_attack_group.yml b/stories/orangeworm_attack_group.yml index a8b1b54459..0e621be260 100644 --- a/stories/orangeworm_attack_group.yml +++ b/stories/orangeworm_attack_group.yml @@ -3,6 +3,7 @@ id: bb9f5ed2-916e-4364-bb6d-97c370efcf52 version: 2 date: '2020-01-22' author: David Dorsey, Splunk +status: production description: Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative: 'In May of 2018, the attack group Orangeworm was implicated for installing diff --git a/stories/outlook_rce_cve_2024_21378.yml b/stories/outlook_rce_cve_2024_21378.yml index 5313d30a96..7c44e285fc 100644 --- a/stories/outlook_rce_cve_2024_21378.yml +++ b/stories/outlook_rce_cve_2024_21378.yml @@ -3,6 +3,7 @@ id: d889fcf2-0265-4b44-b29f-4ec063c21880 version: 1 date: '2024-03-20' author: Michael Haag, Teoderick Contreras, Splunk +status: production description: CVE-2024-21378 exposes a critical vulnerability in Microsoft Outlook, allowing for authenticated remote code execution (RCE) through the manipulation of synced form objects. Discovered by NetSPI in 2023, this vulnerability capitalizes on the unchanged syncing capability of form objects, despite previous patches aimed at securing script code in custom forms. This technical blog delves into the discovery and weaponization of CVE-2024-21378, enhancing the Outlook penetration testing tool, Ruler, to exploit this flaw. A forthcoming pull request will provide a proof-of-concept code, aiding organizations in mitigating this security risk. narrative: CVE-2024-21378 is a weakness in Microsoft Outlook that lets hackers execute code remotely if they can authenticate themselves. Researchers at NetSPI found this issue in 2023. The problem started with a technique from 2017 by Etienne Stalmans at SensePost, who found a way to run code using VBScript in Outlook forms. Microsoft tried to fix it by only allowing approved script code in custom forms, but they didn't fix the main issue, which is how these forms sync. To exploit this vulnerability, you need to know how Outlook forms sync, using something called MAPI, and how they use certain properties and attachments when they're set up for the first time. Hackers can mess with these properties and attachments to run their own code. They do this by tricking the form's setup process, changing registry keys and files to get past Outlook's security. To show how this could be done, researchers modified Ruler, a tool for testing Outlook's security. They changed it so it could sync a harmful form with the right properties to run a specific type of file, a COM compliant native DLL. This not only showed that CVE-2024-21378 could be exploited but also that it could affect a lot of companies since so many use Microsoft Outlook. The discovery and the way it was exploited remind us that we always need to be on the lookout for security risks and work hard to protect against them. The cybersecurity world is always watching for the next big threat that could put our digital world at risk. As companies rush to fix this issue, it's a reminder of how important it is to stay ahead of these threats. references: diff --git a/stories/papercut_mf_ng_vulnerability.yml b/stories/papercut_mf_ng_vulnerability.yml index 5ff3d05d4d..5f2c746e72 100644 --- a/stories/papercut_mf_ng_vulnerability.yml +++ b/stories/papercut_mf_ng_vulnerability.yml @@ -3,6 +3,7 @@ id: 2493d270-5665-4fb4-99c7-8f886f260676 version: 1 date: '2023-05-15' author: Michael Haag, Splunk +status: production description: The FBI has issued a joint advisory concerning the exploitation of a PaperCut MF/NG vulnerability (CVE-2023-27350) by malicious actors, which began in mid-April 2023 and has been ongoing. In early May 2023, a group identifying themselves as the Bl00dy Ransomware Gang targeted vulnerable PaperCut servers within the Education Facilities Subsector. The advisory provides information on detecting exploitation attempts and shares known indicators of compromise (IOCs) associated with the group's activities. narrative: 'PaperCut MF/NG versions 19 and older have reached their end-of-life, as documented on the End of Life Policy page. Customers using these older versions are advised to purchase an updated license online for PaperCut NG or through their PaperCut Partner for PaperCut MF. For users with a currently supported version (version 20 or later), they can upgrade to any maintenance release version they are licensed for. If upgrading to a security patch is not possible, there are alternative options to enhance security. Users can lock down network access to their server(s) by blocking all inbound traffic from external IPs to the web management port (port 9191 and 9192 by default) and blocking all inbound traffic to the web management portal on the firewall to the server. Additionally, users can apply "Allow list" restrictions under Options > Advanced > Security > Allowed site server IP addresses, setting this to only allow the IP addresses of verified Site Servers on their network. diff --git a/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml b/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml index f8ac2cae36..1b8fe735fe 100644 --- a/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml +++ b/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml @@ -3,6 +3,7 @@ id: 97aecafc-0a68-11ec-962f-acde48001122 version: 1 date: '2021-08-31' author: Michael Haag, Mauricio Velazco, Splunk +status: production description: PetitPotam (CVE-2021-36942,) is a vulnerablity identified in Microsofts EFSRPC Protocol that can allow an unauthenticated account to escalate privileges to domain administrator given the right circumstances. diff --git a/stories/phemedrone_stealer.yml b/stories/phemedrone_stealer.yml index 495551ddc8..2ae36951b3 100644 --- a/stories/phemedrone_stealer.yml +++ b/stories/phemedrone_stealer.yml @@ -3,6 +3,7 @@ id: 386f64dd-657b-4dcf-8eb3-5e297d30924c version: 2 date: '2024-01-24' author: Teoderick Contreras, Splunk +status: production description: Phemedrone Stealer is a potent data-stealing malware designed to infiltrate systems discreetly, primarily targeting sensitive user information. Operating with a stealthy modus operandi, it covertly collects and exfiltrates critical data such as login credentials, personal details, and financial information. diff --git a/stories/plugx.yml b/stories/plugx.yml index f46c0ea342..fa2824c6ad 100644 --- a/stories/plugx.yml +++ b/stories/plugx.yml @@ -3,6 +3,7 @@ id: a2c94c99-b93b-4bc7-a749-e2198743d0d6 version: 2 date: '2023-10-12' author: Teoderick Contreras, Splunk +status: production description: PlugX, also referred to as "PlugX RAT" or "Kaba," is a highly sophisticated remote access Trojan (RAT) discovered in 2012. This malware is notorious for its involvement in targeted cyberattacks, primarily driven by cyber espionage objectives. PlugX provides attackers with comprehensive remote control capabilities over compromised systems, diff --git a/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml b/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml index e9564a1575..a64fe677f0 100644 --- a/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml +++ b/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml @@ -3,6 +3,7 @@ id: 988C59C5-0A1C-45B6-A555-0C62276E327E version: 1 date: '2020-01-22' author: iDefense Cyber Espionage Team, iDefense +status: production description: Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative: 'This story was created as a joint effort between iDefense and Splunk. diff --git a/stories/prestige_ransomware.yml b/stories/prestige_ransomware.yml index 3e3fe57945..bd2296488b 100644 --- a/stories/prestige_ransomware.yml +++ b/stories/prestige_ransomware.yml @@ -3,6 +3,7 @@ id: 8b8d8506-b931-450c-b794-f24184ca1deb version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Prestige Ransomware narrative: This story addresses Prestige ransomware. This ransomware payload seen by Microsoft diff --git a/stories/printnightmare_cve_2021_34527.yml b/stories/printnightmare_cve_2021_34527.yml index 56a6908367..65728a81c3 100644 --- a/stories/printnightmare_cve_2021_34527.yml +++ b/stories/printnightmare_cve_2021_34527.yml @@ -3,6 +3,7 @@ id: fd79470a-da88-11eb-b803-acde48001122 version: 1 date: '2021-07-01' author: Splunk Threat Research Team +status: production description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. diff --git a/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml b/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml index 28adf6d265..5587506c60 100644 --- a/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml +++ b/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml @@ -3,6 +3,7 @@ id: 6d13121c-90f3-446d-8ac3-27efbbc65218 version: 1 date: '2017-09-11' author: Rico Valdez, Splunk +status: production description: Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. diff --git a/stories/proxynotshell.yml b/stories/proxynotshell.yml index 2aac8530e9..ac8d66c666 100644 --- a/stories/proxynotshell.yml +++ b/stories/proxynotshell.yml @@ -3,6 +3,7 @@ id: 4e3f17e7-9ed7-425d-a05e-b65464945836 version: 1 date: '2022-09-30' author: Michael Haag, Splunk +status: production description: Two new zero day Microsoft Exchange vulnerabilities have been identified actively exploited in the wild - CVE-2022-41040 and CVE-2022-41082. narrative: Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker. Originally identified by GTSC monitoring Exchange, some adversary post-exploitation activity was identified and is tagged to this story. references: diff --git a/stories/proxyshell.yml b/stories/proxyshell.yml index 953d003a84..98e629822d 100644 --- a/stories/proxyshell.yml +++ b/stories/proxyshell.yml @@ -3,6 +3,7 @@ id: 413bb68e-04e2-11ec-a835-acde48001122 version: 1 date: '2021-08-24' author: Michael Haag, Teoderick Contreras, Mauricio Velazco, Splunk +status: production description: ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. narrative: "During Pwn2Own April 2021, a security researcher demonstrated an attack diff --git a/stories/pxa_stealer.yml b/stories/pxa_stealer.yml index 597e80e711..a44ad24c4f 100644 --- a/stories/pxa_stealer.yml +++ b/stories/pxa_stealer.yml @@ -3,6 +3,7 @@ id: 66f64651-e4e0-4d3b-8d7d-41d8e598e4e1 version: 1 date: '2024-11-18' author: Teoderick Contreras, Splunk +status: production description: This following analytic story contains detections related to the PXA Stealer, a malicious software tool designed to covertly extract sensitive information from infected systems. This data-stealing malware targets credentials, personal data, browsing information, and financial information by exploiting system vulnerabilities or tricking users into downloading it via phishing campaigns or malicious links. PXA Stealer often operates stealthily, bypassing security measures and transmitting stolen data to cybercriminals. Its capabilities make it a significant threat to individuals and organizations, emphasizing the need for robust cybersecurity defenses and awareness. narrative: The PXA Stealer initiates its attack in disguise, often concealed within phishing emails or dubious downloads. Once executed, it infiltrates the system undetected, harvesting credentials, financial information, and personal files. Its cunning lies in its ability to evade antivirus software and blend into normal processes. However, its subtle movements leave traces. Unusual system slowdowns, unauthorized login attempts, or increased network activity can indicate its presence. To detect and prevent it, maintain updated antivirus software, enable multi-factor authentication, and avoid clicking on suspicious links or attachments. Vigilance and proactive monitoring are key defenses against this silent intruder. references: diff --git a/stories/qakbot.yml b/stories/qakbot.yml index 48378bed4d..871ee43a36 100644 --- a/stories/qakbot.yml +++ b/stories/qakbot.yml @@ -3,6 +3,7 @@ id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6 version: 2 date: '2022-11-14' author: Teoderick Contreras, Splunk +status: production description: QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware (ref. MITRE ATT&CK). narrative: QakBot notably has made its way on the CISA top malware list for 2021. QakBot for years has been under continious improvement when it comes to initial access, injection and post-exploitation. Multiple adversaries use QakBot to gain initial access and persist, most notably TA551. The actor(s) behind QakBot possess a modular framework consisting of maldoc builders, signed loaders, and DLLs that produce initially low detection rates at the beginning of the attack, which creates opportunities to deliver additional malware such as Egregor and Cobalt Strike. (ref. Cybersecurity ATT) diff --git a/stories/ransomware.yml b/stories/ransomware.yml index 9ea584be76..99abf2c501 100644 --- a/stories/ransomware.yml +++ b/stories/ransomware.yml @@ -3,6 +3,7 @@ id: cf309d0d-d4aa-4fbb-963d-1e79febd3756 version: 1 date: '2020-02-04' author: David Dorsey, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected diff --git a/stories/ransomware_cloud.yml b/stories/ransomware_cloud.yml index 21bc9adb1e..4f69a6c55e 100644 --- a/stories/ransomware_cloud.yml +++ b/stories/ransomware_cloud.yml @@ -3,6 +3,7 @@ id: f52f6c43-05f8-4b19-a9d3-5b8c56da91c2 version: 1 date: '2020-10-27' author: Rod Soto, David Dorsey, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. diff --git a/stories/redline_stealer.yml b/stories/redline_stealer.yml index 09bf787aca..aa49b2b562 100644 --- a/stories/redline_stealer.yml +++ b/stories/redline_stealer.yml @@ -3,6 +3,7 @@ id: 12e31e8b-671b-4d6e-b362-a682812a71eb version: 1 date: '2023-04-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Redline Stealer trojan, including looking for file writes associated with its payload, screencapture, registry modification, persistence diff --git a/stories/remcos.yml b/stories/remcos.yml index d9fcf5c0ba..4ae7d93336 100644 --- a/stories/remcos.yml +++ b/stories/remcos.yml @@ -3,6 +3,7 @@ id: 2bd4aa08-b9a5-40cf-bfe5-7d43f13d496c version: 1 date: '2021-09-23' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence diff --git a/stories/reverse_network_proxy.yml b/stories/reverse_network_proxy.yml index 5790f6e39e..f5257404f6 100644 --- a/stories/reverse_network_proxy.yml +++ b/stories/reverse_network_proxy.yml @@ -3,6 +3,7 @@ id: 265e4127-21fd-43e4-adac-ec5d12274111 version: 1 date: '2022-11-16' author: Michael Haag, Splunk +status: production description: The following analytic story describes applications that may be abused to reverse proxy back into an organization, either for persistence or remote access. narrative: This analytic story covers tools like Ngrok which is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. Ngrok in particular has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration. There are many open source and closed/paid that fall into this reverse proxy category. The analytic story and complemented analytics will be released as more are identified. diff --git a/stories/revil_ransomware.yml b/stories/revil_ransomware.yml index d1f11f81e4..801129da7d 100644 --- a/stories/revil_ransomware.yml +++ b/stories/revil_ransomware.yml @@ -3,6 +3,7 @@ id: 817cae42-f54b-457a-8a36-fbf45521e29e version: 1 date: '2021-06-04' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry diff --git a/stories/rhysida_ransomware.yml b/stories/rhysida_ransomware.yml index 1270c11c2e..ab821951ad 100644 --- a/stories/rhysida_ransomware.yml +++ b/stories/rhysida_ransomware.yml @@ -3,6 +3,7 @@ id: 0925ee49-1185-4484-94ac-7867764a9183 version: 1 date: '2023-12-12' author: Teoderick Contreras, Splunk +status: production description: Utilize analytics designed to identify and delve into atypical behaviors, potentially associated with the Rhysida Ransomware. Employing these searches enables the detection of irregular patterns or actions within systems or networks, serving as proactive measures to spot potential diff --git a/stories/router_and_infrastructure_security.yml b/stories/router_and_infrastructure_security.yml index a042290e74..f24e6c02fa 100644 --- a/stories/router_and_infrastructure_security.yml +++ b/stories/router_and_infrastructure_security.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e177e77 version: 1 date: '2017-09-12' author: Bhavin Patel, Splunk +status: production description: Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. diff --git a/stories/ryuk_ransomware.yml b/stories/ryuk_ransomware.yml index f3f58d9fbe..1b23726919 100644 --- a/stories/ryuk_ransomware.yml +++ b/stories/ryuk_ransomware.yml @@ -3,6 +3,7 @@ id: 507edc74-13d5-4339-878e-b9744ded1f35 version: 1 date: '2020-11-06' author: Jose Hernandez, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, diff --git a/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml b/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml index c51978b246..81353384c7 100644 --- a/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml +++ b/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml @@ -3,6 +3,7 @@ id: 0244fdee-61be-11ec-900e-acde48001122 version: 1 date: '2021-12-20' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities. diff --git a/stories/samsam_ransomware.yml b/stories/samsam_ransomware.yml index 3f5b4a718c..cae7c5ecc3 100644 --- a/stories/samsam_ransomware.yml +++ b/stories/samsam_ransomware.yml @@ -3,6 +3,7 @@ id: c4b89506-fbcf-4cb7-bfd6-527e54789604 version: 1 date: '2018-12-13' author: Rico Valdez, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware diff --git a/stories/sandworm_tools.yml b/stories/sandworm_tools.yml index 1387a84de7..8cc6b5f357 100644 --- a/stories/sandworm_tools.yml +++ b/stories/sandworm_tools.yml @@ -3,6 +3,7 @@ id: 54146850-9d26-4877-a611-2db33231e63e version: 1 date: '2022-04-05' author: Teoderick Contreras, Splunk +status: production description: This analytic story features detections that enable security analysts to identify and investigate unusual activities potentially related to the destructive malware and tools employed by the "Sandworm" group. This analytic story focuses on monitoring suspicious process executions, command-line activities, Master Boot Record (MBR) wiping, data destruction, and other related indicators. narrative: The Sandworm group's tools are part of destructive malware operations designed to disrupt or attack Ukraine's National Information Agencies. This operation campaign consists of several malware components, including scripts, native Windows executables (LOLBINs), data wiper malware that overwrites or destroys the Master Boot Record (MBR), and file wiping using sdelete.exe on targeted hosts. references: diff --git a/stories/scheduled_tasks.yml b/stories/scheduled_tasks.yml index 7d038b6459..c55d37d90d 100644 --- a/stories/scheduled_tasks.yml +++ b/stories/scheduled_tasks.yml @@ -3,6 +3,7 @@ id: 94cff925-d05c-40cf-b925-d6c5702a2399 version: 1 date: '2023-06-12' author: Michael Haag, Splunk +status: production description: The MITRE ATT&CK technique T1053 refers to Scheduled Task/Job. Adversaries might use task scheduling utilities to execute programs or scripts at a predefined date and time. This method is often used for persistence but can also be used for privilege escalation or to execute tasks under certain conditions. Scheduling tasks can be beneficial for an attacker as it can allow them to execute actions at times when the system is less likely to be monitored actively. Different operating systems have different utilities for task scheduling, for example, Unix-like systems have Cron, while Windows has Scheduled Tasks and At Jobs. narrative: MITRE ATT&CK technique T1053, labeled "Scheduled Task/Job", is a categorization of methods that adversaries use to execute malicious code by scheduling tasks or jobs on a system. This technique is widely utilized for persistence, privilege escalation, and the remote execution of tasks. The technique is applicable across various environments and platforms, including Windows, Linux, and macOS. diff --git a/stories/shrinklocker.yml b/stories/shrinklocker.yml index f2e19acab4..dd7e9455b5 100644 --- a/stories/shrinklocker.yml +++ b/stories/shrinklocker.yml @@ -3,6 +3,7 @@ id: 11fb26d7-11d3-4839-9ee7-63c1329bff8c version: 1 date: '2024-06-17' author: Teoderick Contreras, Splunk +status: production description: ShrinkLocker is a new ransomware that uses Windows BitLocker to encrypt files by creating new boot partitions. It targets non-boot partitions, shrinks them, and creates new boot volumes. ShrinkLocker has attacked a government entity and companies in the vaccine and manufacturing sectors. The ransomware doesn't drop a ransom note but uses the boot partition label diff --git a/stories/signed_binary_proxy_execution_installutil.yml b/stories/signed_binary_proxy_execution_installutil.yml index ad01c1d41f..38575e2ad7 100644 --- a/stories/signed_binary_proxy_execution_installutil.yml +++ b/stories/signed_binary_proxy_execution_installutil.yml @@ -3,6 +3,7 @@ id: 9482a314-43dc-11ec-a3c9-acde48001122 version: 1 date: '2021-11-12' author: Michael Haag, Splunk +status: production description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. narrative: 'InstallUtil is a command-line utility that allows for installation and diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml index e618ef203d..af931b88a5 100644 --- a/stories/silver_sparrow.yml +++ b/stories/silver_sparrow.yml @@ -3,6 +3,7 @@ id: cb4f48fe-7699-11eb-af77-acde48001122 version: 1 date: '2021-02-24' author: Michael Haag, Splunk +status: production description: Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. diff --git a/stories/snake_keylogger.yml b/stories/snake_keylogger.yml index f737c4cf14..7e6bf544d5 100644 --- a/stories/snake_keylogger.yml +++ b/stories/snake_keylogger.yml @@ -3,6 +3,7 @@ id: 0374f962-c66a-4a67-9a30-24b0708ef802 version: 1 date: '2024-02-12' author: Teoderick Contreras, Splunk +status: production description: SnakeKeylogger is a stealthy malware designed to secretly record keystrokes on infected devices. It operates covertly in the background, capturing sensitive information such as passwords and credit card details. This keylogging threat poses a significant risk to user privacy and security. diff --git a/stories/snake_malware.yml b/stories/snake_malware.yml index 5b6a3512e3..82ab496cb9 100644 --- a/stories/snake_malware.yml +++ b/stories/snake_malware.yml @@ -3,6 +3,7 @@ id: 032bacbb-f90d-43aa-bbcc-d87f169a29c8 version: 1 date: '2023-05-10' author: Michael Haag, Splunk +status: production description: The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive targets. narrative: The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive diff --git a/stories/sneaky_active_directory_persistence_tricks.yml b/stories/sneaky_active_directory_persistence_tricks.yml index b703db7c90..e89a019084 100644 --- a/stories/sneaky_active_directory_persistence_tricks.yml +++ b/stories/sneaky_active_directory_persistence_tricks.yml @@ -3,6 +3,7 @@ id: f676c4c1-c769-4ecb-9611-5fd85b497c56 version: 2 date: '2024-03-14' author: Dean Luxton, Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Windows Active Directory persistence techniques. narrative: Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Active Directory is a centralized and hierarchical database that stores information about users, computers, and other resources on a network. It provides secure and efficient management diff --git a/stories/spearphishing_attachments.yml b/stories/spearphishing_attachments.yml index 100efe95ec..6cf46e93a7 100644 --- a/stories/spearphishing_attachments.yml +++ b/stories/spearphishing_attachments.yml @@ -3,6 +3,7 @@ id: 57226b40-94f3-4ce5-b101-a75f67759c27 version: 1 date: '2019-04-29' author: Splunk Research Team, Splunk +status: production description: Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative: 'Despite its simplicity, phishing remains the most pervasive and dangerous diff --git a/stories/spring4shell_cve_2022_22965.yml b/stories/spring4shell_cve_2022_22965.yml index 08345cf642..a0e425a25e 100644 --- a/stories/spring4shell_cve_2022_22965.yml +++ b/stories/spring4shell_cve_2022_22965.yml @@ -3,6 +3,7 @@ id: dcc19913-6918-4ed2-bbba-a6b484c10ef4 version: 2 date: '2024-09-24' author: Michael Haag, Splunk +status: production description: Spring4Shell is the nickname given to a zero-day vulnerability in the Spring Core Framework, a programming and configuration model for Java-based enterprise applications. narrative: 'An attacker could exploit Spring4Shell by sending a specially crafted request to a vulnerable server. However, exploitation of Spring4Shell requires certain prerequisites, whereas the original Log4Shell vulnerability affected all versions of Log4j 2 using the default configuration. diff --git a/stories/sql_injection.yml b/stories/sql_injection.yml index 0838a17274..b8cbeb1283 100644 --- a/stories/sql_injection.yml +++ b/stories/sql_injection.yml @@ -3,6 +3,7 @@ id: 4f6632f5-449c-4686-80df-57625f59bab3 version: 1 date: '2017-09-19' author: Bhavin Patel, Splunk +status: production description: Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters. diff --git a/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml b/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml index d446c2f408..3d06aa2123 100644 --- a/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml +++ b/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml @@ -3,6 +3,7 @@ id: 7faf91b6-532a-4f18-807c-b2761e90b6dc version: 1 date: '2023-10-10' author: Michael Haag, Splunk +status: production description: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. This technique involves modifying the Dll and FuncName Registry values that point to the dynamic link library (DLL) providing a SIP's function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value, an adversary can apply an acceptable signature value to all files using that SIP. This can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. narrative: In user mode, Windows Authenticode digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code. The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats and are identified by globally unique identifiers (GUIDs). Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed. references: diff --git a/stories/suspicious_aws_login_activities.yml b/stories/suspicious_aws_login_activities.yml index 8ec3aab745..19956ad2c3 100644 --- a/stories/suspicious_aws_login_activities.yml +++ b/stories/suspicious_aws_login_activities.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c59f1268af3 version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk +status: production description: 'Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.' diff --git a/stories/suspicious_aws_s3_activities.yml b/stories/suspicious_aws_s3_activities.yml index 4d480bbffa..e39ac23014 100644 --- a/stories/suspicious_aws_s3_activities.yml +++ b/stories/suspicious_aws_s3_activities.yml @@ -3,6 +3,7 @@ id: 66732346-8fb0-407b-9633-da16756567d6 version: 3 date: '2023-04-24' author: Bhavin Patel, Splunk +status: production description: Use the searches in this Analytic Story using Cloudtrail logs to to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP, permission and policy updates to the bucket, potential misuse of other services leading to data being leaked. diff --git a/stories/suspicious_aws_traffic.yml b/stories/suspicious_aws_traffic.yml index 833fb4f004..d8d36dab50 100644 --- a/stories/suspicious_aws_traffic.yml +++ b/stories/suspicious_aws_traffic.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f2168af3 version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk +status: production description: Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). diff --git a/stories/suspicious_cloud_authentication_activities.yml b/stories/suspicious_cloud_authentication_activities.yml index 44c0e56a6e..32c56b1591 100644 --- a/stories/suspicious_cloud_authentication_activities.yml +++ b/stories/suspicious_cloud_authentication_activities.yml @@ -3,6 +3,7 @@ id: 6380ebbb-55c5-4fce-b754-01fd565fb73c version: 2 date: '2024-09-24' author: Rico Valdez, Splunk +status: production description: 'Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.' diff --git a/stories/suspicious_cloud_instance_activities.yml b/stories/suspicious_cloud_instance_activities.yml index a150ffaa21..524ea6028b 100644 --- a/stories/suspicious_cloud_instance_activities.yml +++ b/stories/suspicious_cloud_instance_activities.yml @@ -3,6 +3,7 @@ id: 8168ca88-392e-42f4-85a2-767579c660ce version: 1 date: '2020-08-25' author: David Dorsey, Splunk +status: production description: Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. diff --git a/stories/suspicious_cloud_provisioning_activities.yml b/stories/suspicious_cloud_provisioning_activities.yml index 72fdc5772d..1383242e55 100644 --- a/stories/suspicious_cloud_provisioning_activities.yml +++ b/stories/suspicious_cloud_provisioning_activities.yml @@ -3,6 +3,7 @@ id: 51045ded-1575-4ba6-aef7-af6c73cffd86 version: 1 date: '2018-08-20' author: David Dorsey, Splunk +status: production description: Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. diff --git a/stories/suspicious_cloud_user_activities.yml b/stories/suspicious_cloud_user_activities.yml index f7ddc5ac2e..65b679c4d8 100644 --- a/stories/suspicious_cloud_user_activities.yml +++ b/stories/suspicious_cloud_user_activities.yml @@ -3,6 +3,7 @@ id: 1ed5ce7d-5469-4232-92af-89d1a3595b39 version: 1 date: '2020-09-04' author: David Dorsey, Splunk +status: production description: Detect and investigate suspicious activities by users and roles in your cloud environments. narrative: 'It seems obvious that it is critical to monitor and control the users diff --git a/stories/suspicious_command_line_executions.yml b/stories/suspicious_command_line_executions.yml index 76a5d1f9fc..d4bef5eca9 100644 --- a/stories/suspicious_command_line_executions.yml +++ b/stories/suspicious_command_line_executions.yml @@ -3,6 +3,7 @@ id: f4368ddf-d59f-4192-84f6-778ac5a3ffc7 version: 2 date: '2020-02-03' author: Bhavin Patel, Splunk +status: production description: Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI diff --git a/stories/suspicious_compiled_html_activity.yml b/stories/suspicious_compiled_html_activity.yml index e542ca58b4..d6650332b8 100644 --- a/stories/suspicious_compiled_html_activity.yml +++ b/stories/suspicious_compiled_html_activity.yml @@ -1,5 +1,6 @@ author: Michael Haag, Splunk date: '2021-02-11' +status: production description: Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. id: a09db4d1-3827-4833-87b8-3a397e532119 diff --git a/stories/suspicious_dns_traffic.yml b/stories/suspicious_dns_traffic.yml index e2220a8d33..f940637476 100644 --- a/stories/suspicious_dns_traffic.yml +++ b/stories/suspicious_dns_traffic.yml @@ -3,6 +3,7 @@ id: 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56 version: 1 date: '2017-09-18' author: Rico Valdez, Splunk +status: production description: Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. diff --git a/stories/suspicious_emails.yml b/stories/suspicious_emails.yml index e8b9a0ef5a..fa00f0c715 100644 --- a/stories/suspicious_emails.yml +++ b/stories/suspicious_emails.yml @@ -3,6 +3,7 @@ id: 2b1800dd-92f9-47ec-a981-fdf1351e5d55 version: 1 date: '2020-01-27' author: Bhavin Patel, Splunk +status: production description: Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. diff --git a/stories/suspicious_gcp_storage_activities.yml b/stories/suspicious_gcp_storage_activities.yml index 9f26360fb0..626784cb6f 100644 --- a/stories/suspicious_gcp_storage_activities.yml +++ b/stories/suspicious_gcp_storage_activities.yml @@ -3,6 +3,7 @@ id: 4d656b2e-d6be-11ea-87d0-0242ac130003 version: 1 date: '2020-08-05' author: Shannon Davis, Splunk +status: production description: Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml index d39914c98d..3dcbf4634a 100644 --- a/stories/suspicious_mshta_activity.yml +++ b/stories/suspicious_mshta_activity.yml @@ -3,6 +3,7 @@ id: 1e5a5a53-540b-462a-8fb7-f44a4292f5dc version: 2 date: '2021-01-20' author: Bhavin Patel, Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative: 'One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_okta_activity.yml b/stories/suspicious_okta_activity.yml index 219a348ed0..59410c1899 100644 --- a/stories/suspicious_okta_activity.yml +++ b/stories/suspicious_okta_activity.yml @@ -3,6 +3,7 @@ id: 9cbd34af-8f39-4476-a423-bacd126c750b version: 1 date: '2020-04-02' author: Rico Valdez, Splunk +status: production description: Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they diff --git a/stories/suspicious_regsvcs_regasm_activity.yml b/stories/suspicious_regsvcs_regasm_activity.yml index 2196acbe57..ff6aadf5ea 100644 --- a/stories/suspicious_regsvcs_regasm_activity.yml +++ b/stories/suspicious_regsvcs_regasm_activity.yml @@ -1,5 +1,6 @@ author: Michael Haag, Splunk date: '2024-09-24' +status: production description: Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. id: 2cdf33a0-4805-4b61-b025-59c20f418fbe diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml index b14757bc11..bf8b318e92 100644 --- a/stories/suspicious_regsvr32_activity.yml +++ b/stories/suspicious_regsvr32_activity.yml @@ -3,6 +3,7 @@ id: b8bee41e-624f-11eb-ae93-0242ac130002 version: 1 date: '2021-01-29' author: Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. narrative: One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_rundll32_activity.yml b/stories/suspicious_rundll32_activity.yml index b15e91548d..92edab4242 100644 --- a/stories/suspicious_rundll32_activity.yml +++ b/stories/suspicious_rundll32_activity.yml @@ -3,6 +3,7 @@ id: 80a65487-854b-42f1-80a1-935e4c170694 version: 1 date: '2021-02-03' author: Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. narrative: One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_windows_registry_activities.yml b/stories/suspicious_windows_registry_activities.yml index 4362c447ad..8f069b1b62 100644 --- a/stories/suspicious_windows_registry_activities.yml +++ b/stories/suspicious_windows_registry_activities.yml @@ -3,6 +3,7 @@ id: 2b1800dd-92f9-47dd-a981-fdf1351e5d55 version: 1 date: '2018-05-31' author: Bhavin Patel, Splunk +status: production description: Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative: "Attackers are developing increasingly sophisticated techniques for hijacking diff --git a/stories/suspicious_wmi_use.yml b/stories/suspicious_wmi_use.yml index 7b1743dd5d..e36079c954 100644 --- a/stories/suspicious_wmi_use.yml +++ b/stories/suspicious_wmi_use.yml @@ -3,6 +3,7 @@ id: c8ddc5be-69bc-4202-b3ab-4010b27d7ad5 version: 2 date: '2018-10-23' author: Rico Valdez, Splunk +status: production description: Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it diff --git a/stories/suspicious_zoom_child_processes.yml b/stories/suspicious_zoom_child_processes.yml index 8a92a67596..c3ed962363 100644 --- a/stories/suspicious_zoom_child_processes.yml +++ b/stories/suspicious_zoom_child_processes.yml @@ -3,6 +3,7 @@ id: aa3749a6-49c7-491e-a03f-4eaee5fe0258 version: 1 date: '2020-04-13' author: David Dorsey, Splunk +status: production description: Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. diff --git a/stories/swift_slicer.yml b/stories/swift_slicer.yml index 940ff21fee..59ea094300 100644 --- a/stories/swift_slicer.yml +++ b/stories/swift_slicer.yml @@ -3,6 +3,7 @@ id: 234c9dd7-52fb-4d6f-aec9-075ef88a2cea version: 1 date: '2023-02-01' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the swift slicer malware including overwriting of files and etc. narrative: Swift Slicer is one of Windows destructive malware found by ESET that was used in a targeted organizarion to wipe critical files like windows drivers and other files diff --git a/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml b/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml index 5817f510fe..6e4bf82570 100644 --- a/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml +++ b/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml @@ -3,6 +3,7 @@ id: 228f22cb-3436-4c31-8af4-370d40af7b49 version: 1 date: '2023-11-09' author: Michael Haag, Splunk +status: production description: A zero-day vulnerability was discovered in SysAid's on-premise software, exploited by the group DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads, gaining unauthorized access and control. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and urges customers to conduct a comprehensive compromise assessment. narrative: The analytics tagged to this analytic story will aid in capturing initial access and some post-exploitation activities. In addition to the application spawning a shell, consider reviewing STRT's Cobalt Strike and PowerShell script block logging analytic stories. On November 2nd, SysAid's security team identified a potential vulnerability in their on-premise software. The investigation revealed a zero-day vulnerability exploited by the group known as DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads into the webroot of the SysAid Tomcat web service, thereby gaining unauthorized access and control over the affected system. SysAid promptly initiated their incident response protocol and began proactive communication with their on-premise customers to implement a mitigation solution. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and strongly recommends all customers to conduct a comprehensive compromise assessment of their network. references: diff --git a/stories/text4shell_cve_2022_42889.yml b/stories/text4shell_cve_2022_42889.yml index 4c89b47d19..770e32aa17 100644 --- a/stories/text4shell_cve_2022_42889.yml +++ b/stories/text4shell_cve_2022_42889.yml @@ -3,6 +3,7 @@ id: 95ae800d-485e-47f7-866e-8be281aa497b version: 1 date: '2022-10-26' author: Michael Haag, Splunk +status: production description: A new critical vulnerability CVE-2022-42889 a.k.a. Text4shell, similar to the old Spring4Shell and Log4Shell, was originally reported by Alvaro Munoz on the very popular Apache Commons Text library. narrative: Apache Commons Text is a Java library described as "a library focused on algorithms working on strings." We can see it as a general-purpose text manipulation toolkit. This vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the "script," "dns," and "url" lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups. diff --git a/stories/trickbot.yml b/stories/trickbot.yml index 9ecadb1d99..491f869347 100644 --- a/stories/trickbot.yml +++ b/stories/trickbot.yml @@ -3,6 +3,7 @@ id: 16f93769-8342-44c0-9b1d-f131937cce8e version: 1 date: '2021-04-20' author: Rod Soto, Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection diff --git a/stories/trusted_developer_utilities_proxy_execution.yml b/stories/trusted_developer_utilities_proxy_execution.yml index 4c003ce7b9..0f034643fb 100644 --- a/stories/trusted_developer_utilities_proxy_execution.yml +++ b/stories/trusted_developer_utilities_proxy_execution.yml @@ -3,6 +3,7 @@ id: 270a67a6-55d8-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk +status: production description: Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. narrative: 'Adversaries may take advantage of trusted developer utilities to proxy diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml index 3abbd91e73..060c17f32f 100644 --- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml +++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml @@ -3,6 +3,7 @@ id: be3418e2-551b-11eb-ae93-0242ac130002 version: 1 date: '2021-01-21' author: Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted diff --git a/stories/unusual_processes.yml b/stories/unusual_processes.yml index 2b14759889..4fd817acc6 100644 --- a/stories/unusual_processes.yml +++ b/stories/unusual_processes.yml @@ -3,6 +3,7 @@ id: f4368e3f-d59f-4192-84f6-748ac5a3ddb6 version: 2 date: '2020-02-04' author: Bhavin Patel, Splunk +status: production description: Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples diff --git a/stories/use_of_cleartext_protocols.yml b/stories/use_of_cleartext_protocols.yml index 56ab8001ed..fc2e0cca7e 100644 --- a/stories/use_of_cleartext_protocols.yml +++ b/stories/use_of_cleartext_protocols.yml @@ -3,6 +3,7 @@ id: 826e6431-aeef-41b4-9fc0-6d0985d65a21 version: 1 date: '2017-09-15' author: Bhavin Patel, Splunk +status: production description: Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative: Various legacy protocols operate by default in the clear, without the protections diff --git a/stories/valleyrat.yml b/stories/valleyrat.yml index a53d866238..d40f36f218 100644 --- a/stories/valleyrat.yml +++ b/stories/valleyrat.yml @@ -3,6 +3,7 @@ id: e9703322-5462-4c4a-a427-b9895c1472de version: 1 date: '2024-09-11' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might be related to ValleyRAT malware. ValleyRAT is a remote access trojan (RAT) known for targeting specific organizations and individuals to gain unauthorized access to systems. It enables attackers to execute commands, steal sensitive data, and manipulate files. This malware often uses phishing emails or malicious attachments to infect systems. Detecting ValleyRAT early is crucial to preventing data breaches and further exploitation. Analysts can use behavioral analysis and signature-based detection to mitigate its impact. narrative: ValleyRAT is a stealthy remote access trojan (RAT) used by cybercriminals to gain unauthorized control over compromised systems. It often infiltrates targets through phishing emails or malicious attachments, allowing attackers to execute commands, steal sensitive information, manipulate files, and monitor user activities remotely. Once inside, ValleyRAT can evade detection by blending in with legitimate processes, making it challenging to identify. references: diff --git a/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml index 479d8c0696..ea6d8b659b 100644 --- a/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml +++ b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml @@ -3,6 +3,7 @@ id: 99171cdd-57a1-4b8a-873c-f8bee12e2025 version: 1 date: '2023-06-21' author: Michael Haag, Splunk +status: production description: CVE-2023-20887 is a critical vulnerability affecting VMware's vRealize Network Insight (also known as VMware Aria Operations for Networks). It allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges via the Apache Thrift RPC interface. The exploit, which has a severity score of 9.8, targets an endpoint ("/saas./resttosaasservlet") in the application and delivers a malicious payload designed to create a reverse shell, granting the attacker control over the system. VMware has released an advisory recommending users to update to the latest version to mitigate this threat. narrative: CVE-2023-20887 is a highly critical vulnerability found in VMware's vRealize Network Insight. This software is widely used for intelligent operations management across physical, virtual, and cloud environments, so a vulnerability in it poses a significant risk to many organizations. diff --git a/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml b/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml index 1287d494c8..9c78c40d9d 100644 --- a/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml +++ b/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml @@ -3,6 +3,7 @@ id: cb77a38a-bc37-42f8-9e34-64ccc7985277 version: 1 date: '2024-07-30' author: Michael Haag, Splunk +status: production description: This analytic story addresses the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). It detects attempts to exploit this flaw, which allows attackers with sufficient AD permissions to gain full access to ESXi hosts by recreating the 'ESX Admins' group after deletion. narrative: VMware ESXi contains an authentication bypass vulnerability (CVE-2024-37085) that allows attackers to gain unauthorized access to ESXi hosts. Ransomware groups have been observed exploiting this flaw to deploy malware and encrypt virtual machines. This story focuses on detecting potential exploitation attempts, suspicious Active Directory group modifications. It aims to help defenders identify and respond to attacks leveraging this vulnerability in their virtualized environments. references: diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index c4b781a16e..2446d78bc8 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -3,6 +3,7 @@ id: d6d51cc2-a092-43b7-9f61-1159943afe39 version: 1 date: '2022-05-19' author: Michael Haag, Splunk +status: production description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. diff --git a/stories/volt_typhoon.yml b/stories/volt_typhoon.yml index 235462c3e1..495436b753 100644 --- a/stories/volt_typhoon.yml +++ b/stories/volt_typhoon.yml @@ -3,6 +3,7 @@ id: f73010e4-49eb-44ef-9f3f-2c25a1ae5415 version: 1 date: '2023-05-25' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the "Volt Typhoon" group targeting critical infrastructure organizations in United States and Guam. The affected organizations include the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. This Analytic story looks for suspicious process execution, lolbin execution, command-line activity, lsass dump and many more. narrative: 'Volt Typhoon is a state sponsored group typically focuses on espionage and information gathering. Based on Microsoft Threat Intelligence, This threat actor group puts strong emphasis on stealth in this campaign by relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. diff --git a/stories/warzone_rat.yml b/stories/warzone_rat.yml index 6e01ce2079..6120cb00e2 100644 --- a/stories/warzone_rat.yml +++ b/stories/warzone_rat.yml @@ -3,6 +3,7 @@ id: 8dc84752-f4da-4285-931c-bddd5c4d440b version: 1 date: '2023-07-26' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might related to warzone (Ave maria) RAT. This analytic story looks for suspicious process execution, command-line activity, downloads, persistence, defense evasion and more. narrative: Warzone RAT, also known as Ave Maria, is a sophisticated remote access trojan (RAT) that surfaced in January 2019. diff --git a/stories/whispergate.yml b/stories/whispergate.yml index ad0d9cd5e2..669be3bb55 100644 --- a/stories/whispergate.yml +++ b/stories/whispergate.yml @@ -3,6 +3,7 @@ id: 0150e6e5-3171-442e-83f8-1ccd8599569b version: 1 date: '2022-01-19' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more. diff --git a/stories/windealer_rat.yml b/stories/windealer_rat.yml new file mode 100644 index 0000000000..1417f913a4 --- /dev/null +++ b/stories/windealer_rat.yml @@ -0,0 +1,18 @@ +name: WinDealer RAT +id: 94fdd8b7-ae39-454a-85e8-9f0148eddea6 +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +status: production +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Windealer Remote Access Trojan (RAT), a versatile malware used for data theft and unauthorized system control. Monitor for signs such as unexpected process token adjustment, abnormal file activity, and unauthorized process execution. Investigate indicators of command-and-control (C2) communications, particularly encrypted or obfuscated traffic patterns. Behavioral analysis and endpoint monitoring can help identify suspicious activities linked to this RAT. Early detection and thorough investigation are essential to mitigate the risks posed by Windealer. +narrative: Windealer is a Remote Access Trojan (RAT) designed for stealthy infiltration and control of compromised systems. Often used in cyberespionage and data theft campaigns, it enables attackers to execute commands, exfiltrate sensitive information, and manipulate system functions remotely. Windealer is known for its ability to maintain persistence and communicate with command-and-control (C2) servers using encrypted or obfuscated protocols, making detection challenging. Its deployment often involves phishing, software exploits, or supply chain attacks. Effective detection requires advanced endpoint monitoring and analysis of unusual network behaviors to identify its covert operations. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/windows_applocker.yml b/stories/windows_applocker.yml index 29aefad92e..2e6ec9d358 100644 --- a/stories/windows_applocker.yml +++ b/stories/windows_applocker.yml @@ -3,6 +3,7 @@ id: 7911b245-e74d-48db-b1cf-69f3eb02ca55 version: 1 date: '2024-03-21' author: Michael Haag, Splunk +status: production description: Windows AppLocker is a feature that enhances security by allowing administrators to specify which users or groups can run particular applications in their organization based on unique identities of files. This story covers various aspects of monitoring and managing AppLocker policies, including detecting unauthorized software installations, enforcing best practices for software usage, and identifying potential security breaches through advanced threat detection techniques. Through the use of Splunk Enterprise, Splunk Enterprise Security, and Splunk Cloud, organizations can gain insights into AppLocker events, ensuring compliance with corporate security policies and mitigating risks associated with unauthorized applications. narrative: AppLocker, a built-in Windows security feature, provides organizations with the ability to control application usage across their networks. It enables administrators to define rules based on file names, publishers, and file hashes to allow or deny the execution of applications. This level of control helps in preventing malware and unlicensed software from running, thereby enhancing the security posture of an organization. \ diff --git a/stories/windows_attack_surface_reduction.yml b/stories/windows_attack_surface_reduction.yml index 39c4e61de6..8bbfb015db 100644 --- a/stories/windows_attack_surface_reduction.yml +++ b/stories/windows_attack_surface_reduction.yml @@ -3,6 +3,7 @@ id: 1d61c474-3cd6-4c23-8c68-f128ac4b209b version: 1 date: '2023-11-27' author: Michael Haag, Splunk +status: production description: 'This story contains detections for Windows Attack Surface Reduction (ASR) events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This story contains detections for ASR events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule.' narrative: 'This story contains detections for Windows Attack Surface Reduction (ASR) events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This story contains detections for ASR events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. It includes detections for both block and audit event IDs. Block event IDs are generated when an action is blocked by an ASR rule, while audit event IDs are generated when an action that would be blocked by an ASR rule is allowed to proceed for auditing purposes.' references: diff --git a/stories/windows_bootkits.yml b/stories/windows_bootkits.yml index 0ca7e4baeb..e7e28cc70c 100644 --- a/stories/windows_bootkits.yml +++ b/stories/windows_bootkits.yml @@ -3,6 +3,7 @@ id: 1bef004d-23b2-4c49-8ceb-b59af0745317 version: 1 date: '2023-05-03' author: Michael Haag, Splunk +status: production description: Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. narrative: A bootkit is a sophisticated type of malware that targets the boot sectors of a hard drive, specifically the Master Boot Record (MBR) and Volume Boot Record (VBR). The MBR is the initial section of the disk that is loaded following the hardware initialization process executed by the Basic Input/Output System (BIOS). It houses the boot loader, which is responsible for loading the operating system. In contrast, the VBR is located at the beginning of each partition and contains the boot code for that specific partition. When an adversary gains raw access to the boot drive, they can overwrite the MBR or VBR, effectively diverting the execution during startup from the standard boot loader to the malicious code injected by the attacker. This tampering allows the malware to load before the operating system, enabling it to execute malicious activities stealthily and maintain persistence on the compromised system. diff --git a/stories/windows_certificate_services.yml b/stories/windows_certificate_services.yml index d2985db1a3..6c7a1f7225 100644 --- a/stories/windows_certificate_services.yml +++ b/stories/windows_certificate_services.yml @@ -3,6 +3,7 @@ id: b92b4ac7-0026-4408-a6b5-c1d20658e124 version: 1 date: '2023-02-01' author: Michael Haag, Splunk +status: production description: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. narrative: The following analytic story focuses on remote and local endpoint certificate theft and abuse. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. (MITRE ATT&CK) references: diff --git a/stories/windows_defense_evasion_tactics.yml b/stories/windows_defense_evasion_tactics.yml index b700bfb835..d0e0023c25 100644 --- a/stories/windows_defense_evasion_tactics.yml +++ b/stories/windows_defense_evasion_tactics.yml @@ -3,6 +3,7 @@ id: 56e24a28-5003-4047-b2db-e8f3c4618064 version: 2 date: '2024-09-24' author: David Dorsey, Splunk +status: production description: 'Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others' diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml index ea5d23e596..35401db53c 100644 --- a/stories/windows_discovery_techniques.yml +++ b/stories/windows_discovery_techniques.yml @@ -3,6 +3,7 @@ id: f7aba570-7d59-11eb-825e-acde48001122 version: 1 date: '2021-03-04' author: Michael Hart, Splunk +status: production description: Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack. narrative: Attackers may not have much if any insight into their target's environment diff --git a/stories/windows_dns_sigred_cve_2020_1350.yml b/stories/windows_dns_sigred_cve_2020_1350.yml index 896a58e58d..778c179201 100644 --- a/stories/windows_dns_sigred_cve_2020_1350.yml +++ b/stories/windows_dns_sigred_cve_2020_1350.yml @@ -3,6 +3,7 @@ id: 36dbb206-d073-11ea-87d0-0242ac130003 version: 1 date: '2020-07-28' author: Shannon Davis, Splunk +status: production description: Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker diff --git a/stories/windows_drivers.yml b/stories/windows_drivers.yml index 0788a08230..64313d67de 100644 --- a/stories/windows_drivers.yml +++ b/stories/windows_drivers.yml @@ -3,6 +3,7 @@ id: d0a9323f-9411-4da6-86b2-18c184d750c0 version: 1 date: '2022-03-30' author: Michael Haag, Splunk +status: production description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. narrative: A rootkit on Windows may sometimes be in the form of a Windows Driver. A driver typically has a file extension of .sys, however the internals of a sys file is similar to a Windows DLL. For Microsoft Windows to load a driver, a few requirements are needed. First, it must have a valid signature. Second, typically it should load from the windows\system32\drivers path. There are a few methods to investigate drivers in the environment. Drivers are noisy. An inventory of all drivers is important to understand prevalence. A driver location (Path) is also important when attempting to baseline. Looking at a driver name and path is not enough, we must also explore the signing information. Product, description, company name, signer and signing result are all items to take into account when reviewing drivers. diff --git a/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml index b7c5ec28eb..4fd737c217 100644 --- a/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml +++ b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml @@ -3,6 +3,7 @@ id: 64dea1e5-2c60-461f-b886-05580ed89b5c version: 1 date: '2023-08-24' author: Michael Haag, Splunk +status: production description: In July 2023, CrowdStrike's Falcon Complete managed detection and response (MDR) team uncovered an exploit kit using an unknown vulnerability in the Windows Error Reporting (WER) component. The vulnerability, now identified as CVE-2023-36874, was also independently discovered by Google's Threat Analysis Group. The exploit came to light when suspicious binaries were observed on a European technology system. CrowdStrike's Counter Adversary Operations' analysis revealed a zero-day exploit targeting the WER service, allowing attackers to execute unauthorized code with elevated privileges. The exploit kit seen aimed to spawn a privileged interpreter, displaying the versatility and adaptability of the threat. CrowdStrike has listed some potential indicators of compromise, but these are of low fidelity due to their mutable nature. narrative: In June 2023, CrowdStrike's Falcon Complete team observed suspicious activities on a European technology entity's system. Multiple binaries were dropped onto the system via Remote Desktop Protocol (RDP), some of which were flagged as potential exploits for a known vulnerability. However, a string containing the Russian term for "0day" suggested an unknown vulnerability was at play. Subsequent investigations identified this as a zero-day vulnerability affecting the Windows Error Reporting (WER) component, now known as CVE-2023-36874. diff --git a/stories/windows_file_extension_and_association_abuse.yml b/stories/windows_file_extension_and_association_abuse.yml index 6316df6053..4e0b5c99a9 100644 --- a/stories/windows_file_extension_and_association_abuse.yml +++ b/stories/windows_file_extension_and_association_abuse.yml @@ -3,6 +3,7 @@ id: 30552a76-ac78-48e4-b3c0-de4e34e9563d version: 1 date: '2018-01-26' author: Rico Valdez, Splunk +status: production description: Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different diff --git a/stories/windows_log_manipulation.yml b/stories/windows_log_manipulation.yml index 9f4d430af5..96179a28d8 100644 --- a/stories/windows_log_manipulation.yml +++ b/stories/windows_log_manipulation.yml @@ -3,6 +3,7 @@ id: b6db2c60-a281-48b4-95f1-2cd99ed56835 version: 2 date: '2017-09-12' author: Rico Valdez, Splunk +status: production description: Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. diff --git a/stories/windows_persistence_techniques.yml b/stories/windows_persistence_techniques.yml index 246c73b6a2..1186855ba4 100644 --- a/stories/windows_persistence_techniques.yml +++ b/stories/windows_persistence_techniques.yml @@ -3,6 +3,7 @@ id: 30874d4f-20a1-488f-85ec-5d52ef74e3f9 version: 2 date: '2018-05-31' author: Bhavin Patel, Splunk +status: production description: Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative: Maintaining persistence is one of the first steps taken by attackers after diff --git a/stories/windows_post_exploitation.yml b/stories/windows_post_exploitation.yml index ec3e4e8a17..8130205f46 100644 --- a/stories/windows_post_exploitation.yml +++ b/stories/windows_post_exploitation.yml @@ -3,6 +3,7 @@ id: 992899b7-a5cf-4bcd-bb0d-cf81762188ba version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk +status: production description: This analytic story identifies popular Windows post exploitation tools for example winpeas.bat, winpeas.exe, WinPrivCheck.bat and many more. narrative: These tools allow operators to find possible exploits or paths for privilege escalation and persistence on a targeted host. Ransomware operator like the "Prestige ransomware" also used or abuses these post exploitation tools such as winPEAS to scan for possible avenue to gain privileges and persistence to a targeted diff --git a/stories/windows_privilege_escalation.yml b/stories/windows_privilege_escalation.yml index fcecb3d990..d367f96e05 100644 --- a/stories/windows_privilege_escalation.yml +++ b/stories/windows_privilege_escalation.yml @@ -3,6 +3,7 @@ id: 644e22d3-598a-429c-a007-16fdb802cae5 version: 2 date: '2020-02-04' author: David Dorsey, Splunk +status: production description: Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. diff --git a/stories/windows_registry_abuse.yml b/stories/windows_registry_abuse.yml index f38fad42ea..9d7c90ceb5 100644 --- a/stories/windows_registry_abuse.yml +++ b/stories/windows_registry_abuse.yml @@ -3,6 +3,7 @@ id: 78df1df1-25f1-4387-90f9-c4ea31ce6b75 version: 1 date: '2022-03-17' author: Teoderick Contreras, Splunk +status: production description: Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications diff --git a/stories/windows_service_abuse.yml b/stories/windows_service_abuse.yml index 9f196c709e..036fcb482c 100644 --- a/stories/windows_service_abuse.yml +++ b/stories/windows_service_abuse.yml @@ -3,6 +3,7 @@ id: 6dbd810e-f66d-414b-8dfc-e46de55cbfe2 version: 3 date: '2017-11-02' author: Rico Valdez, Splunk +status: production description: Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are diff --git a/stories/windows_system_binary_proxy_execution_msiexec.yml b/stories/windows_system_binary_proxy_execution_msiexec.yml index 9d96a9c31e..9d08d81b42 100644 --- a/stories/windows_system_binary_proxy_execution_msiexec.yml +++ b/stories/windows_system_binary_proxy_execution_msiexec.yml @@ -3,6 +3,7 @@ id: bea2e16b-4599-46ad-a95b-116078726c68 version: 1 date: '2022-06-16' author: Michael Haag, Splunk +status: production description: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). narrative: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs. Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled. references: diff --git a/stories/winrar_spoofing_attack_cve_2023_38831.yml b/stories/winrar_spoofing_attack_cve_2023_38831.yml index cbe11a8304..b6559c8efd 100644 --- a/stories/winrar_spoofing_attack_cve_2023_38831.yml +++ b/stories/winrar_spoofing_attack_cve_2023_38831.yml @@ -3,6 +3,7 @@ id: 9ba776f3-b8c5-4390-a312-6dab6c5561b9 version: 1 date: '2023-08-29' author: Michael Haag, Splunk +status: production description: Group-IB Threat Intelligence unit discovered a zero-day vulnerability, CVE-2023-38831, in WinRAR, a popular compression tool. Cybercriminals exploited this vulnerability to deliver various malware families, including DarkMe and GuLoader, by crafting ZIP archives with spoofed extensions, which were then distributed on trading forums. Once the malware was executed, it allowed cybercriminals to withdraw funds from brokers' accounts. RARLAB was immediately notified about the vulnerability and released a patch. Group-IB recommends users update WinRAR to the latest version, stay informed about cyber threats, be cautious with unknown attachments, enable 2FA, backup data, and follow the principle of least privilege. narrative: Group-IB Threat Intelligence unit identified a critical zero-day vulnerability, CVE-2023-38831, in WinRAR, a widely used compression tool. This vulnerability was exploited by cybercriminals to craft ZIP archives containing malicious and non-malicious files, distributed on specialized trading forums. The exploit allowed them to spoof file extensions, hiding the launch of malicious scripts within an archive masquerading as a '.jpg', '.txt', or any other file format. When victims opened the specially crafted archive, it executed the malware, leading to unauthorized access to their broker accounts and enabling the cybercriminals to perform illicit financial transactions and withdraw funds. diff --git a/stories/winter_vivern.yml b/stories/winter_vivern.yml index 3c4c58cc0f..893645f94f 100644 --- a/stories/winter_vivern.yml +++ b/stories/winter_vivern.yml @@ -3,6 +3,7 @@ id: 5ce5f311-b311-4568-90ca-0c36781d07a4 version: 1 date: '2023-02-16' author: Teoderick Contreras, Splunk +status: production description: Utilize searches that enable you to detect and investigate unusual activities potentially related to the Winter Vivern malicious software. This includes examining multiple timeout executions, scheduled task creations, screenshots, and downloading files through PowerShell, among other indicators. narrative: The Winter Vivern malware, identified by CERT UA, is designed to download and run multiple PowerShell scripts on targeted hosts. These scripts aim to gather a variety of files with specific extensions, including (.edb, .ems, .eme, .emz, .key, .pem, .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, and .rdg), primarily from desktop directories. In addition to this, the malware captures desktop screenshots and performs data exfiltration using HTTP. To maintain its presence on the targeted host, Winter Vivern also establishes a persistence mechanism, such as creating a scheduled task. references: diff --git a/stories/wordpress_vulnerabilities.yml b/stories/wordpress_vulnerabilities.yml index ce4a55b09d..e5f3253bcd 100644 --- a/stories/wordpress_vulnerabilities.yml +++ b/stories/wordpress_vulnerabilities.yml @@ -3,6 +3,7 @@ id: baeaee14-e439-4c95-91e8-aaedd8265c1c version: 1 date: '2024-02-22' author: Michael Haag, Splunk +status: production description: This analytic story provides a collection of analytics that detect potential exploitation of WordPress vulnerabilities. The analytics are focused on the detection of known vulnerabilities in WordPress plugins and themes. narrative: The following collection of analytics are focused on the detection of known vulnerabilities in WordPress plugins and themes. The analytics are focused on the detection of known vulnerabilities in WordPress plugins and themes. references: diff --git a/stories/ws_ftp_server_critical_vulnerabilities.yml b/stories/ws_ftp_server_critical_vulnerabilities.yml index 909f19a49d..32625f6aa4 100644 --- a/stories/ws_ftp_server_critical_vulnerabilities.yml +++ b/stories/ws_ftp_server_critical_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 60466291-3ab4-452b-9c11-456aa2dc7293 version: 1 date: '2023-10-01' author: Michael Haag, Splunk +status: production description: A critical security advisory was released by Progress Software on September 27, 2023, concerning multiple vulnerabilities in WS_FTP Server, a widely-used secure file transfer solution. The two critical vulnerabilities are CVE-2023-40044, a .NET deserialization flaw, and CVE-2023-42657, a directory traversal vulnerability. Rapid7 has observed active exploitation of these vulnerabilities. Affected versions are prior to 8.7.4 and 8.8.2. Immediate action is advised - upgrade to WS_FTP Server version 8.8.2. For those unable to update, disabling the Ad Hoc Transfer module is suggested as a temporary measure. This comes in the wake of increased scrutiny following the Cl0p ransomware attack on MOVEit Transfer in May 2023. narrative: Two critical vulnerabilities have been identified in WS_FTP Server, a widely-used secure file transfer solution. The first, CVE-2023-40044, is a .NET deserialization flaw that targets the Ad Hoc Transfer module of WS_FTP Server versions earlier than 8.7.4 and 8.8.2. This flaw allows an attacker to execute arbitrary commands on the server's operating system without needing authentication. The second vulnerability, CVE-2023-42657, is a directory traversal flaw that allows attackers to perform unauthorized file operations outside of their authorized WS_FTP folder. In severe cases, the attacker could escape the WS_FTP Server file structure and perform operations on the underlying operating system. Both vulnerabilities have been observed being exploited in the wild and immediate action for mitigation is strongly advised. Updating to WS_FTP Server version 8.8.2 is recommended. For those unable to update, disabling the Ad Hoc Transfer module is suggested as a temporary measure. references: diff --git a/stories/xmrig.yml b/stories/xmrig.yml index b9768c5c04..cd94009b32 100644 --- a/stories/xmrig.yml +++ b/stories/xmrig.yml @@ -3,6 +3,7 @@ id: 06723e6a-6bd8-4817-ace2-5fb8a7b06628 version: 1 date: '2021-05-07' author: Teoderick Contreras, Rod Soto Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting diff --git a/stories/xorddos.yml b/stories/xorddos.yml index 4186ee24f2..d454d7fd86 100644 --- a/stories/xorddos.yml +++ b/stories/xorddos.yml @@ -3,6 +3,7 @@ id: 0958965b-82ea-48d0-bc00-01f1457bc93f version: 1 date: '2024-12-17' author: Teoderick Contreras, Splunk +status: production description: XorDdos is a sophisticated Linux malware that compromises devices to conduct high-capacity Distributed Denial of Service (DDoS) attacks. It employs XOR-based encryption to conceal its communications and utilizes rootkit capabilities to evade detection. The malware typically infiltrates systems through brute-force attacks on SSH services, enabling unauthorized access. Once installed, it can launch DDoS attacks exceeding 150 Gbps. To detect XorDdos, monitor for unusual network traffic patterns, unexpected processes, and unauthorized access attempts. Implementing strong, unique passwords and regularly updating system security measures are essential to mitigate the risk of infection. narrative: XorDdos is a sophisticated Linux malware strain known for leveraging infected devices to launch high-capacity Distributed Denial of Service (DDoS) attacks. First identified in 2014, XorDdos has evolved with advanced techniques to maintain stealth and effectiveness. The malware primarily targets Linux-based systems, infiltrating them through brute-force attacks on SSH services. Once compromised, it uses XOR-based encryption to mask its malicious activities and rootkit capabilities to evade detection. Detection involves monitoring for unusual system behavior, such as spikes in CPU usage, unexpected network traffic, and unauthorized SSH access attempts. Preventative measures include implementing strong passwords, disabling unused services, and ensuring systems are patched with the latest security updates. As this malware continues to adapt, maintaining robust cybersecurity practices is essential to defend against its growing threat. references: diff --git a/stories/zscaler_browser_proxy_threats.yml b/stories/zscaler_browser_proxy_threats.yml index 6c617d3011..7fffa92bd8 100644 --- a/stories/zscaler_browser_proxy_threats.yml +++ b/stories/zscaler_browser_proxy_threats.yml @@ -3,6 +3,7 @@ id: 5d4ba315-39df-4309-982f-a7052efccffd version: 1 date: '2023-10-25' author: Rod Soto, Gowthamaraj Rajendran +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to malicious activity from Zscaler. This also encompasses monitoring for events such as users downloading harmful files or accessing websites that pose a risk to system and network security. Additionally, the narrative extends to the detection of insider threats, ensuring comprehensive protection from both external and internal vulnerabilities. By leveraging Zscaler with Splunk, organizations can fortify their defenses, safeguarding against a wide spectrum of cyber threats and maintaining a secure operational environment. narrative: Zscaler Client Connector is an application installed on your device to ensure that your internet traffic and access to your organization's internal apps are secure and in compliance with your organization's policies, even when you're off your corporate network. references: